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This  is  Volume  III  of  the  final  report  of  Task  C»  sup  IV  of  the  Weapon 
System  Effectiveness  Industry  Advisory  Committee  (WSEIAC).  It  is  sub¬ 
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objectives  cited  in  the  committee  C.»arte-.  The  final  report  is  contained  in 
three  separate  volumes: 


Volume  I  presents  a  summary  of  the  principles  of  cost- 
effectiveness  analysis,  conclusions  and  recommendations. 

Volume  II  contains  a  discussion  of  the  specific  tasks 
required  to  conduct  a  cost-effectiveness  analysis, 
emphasizinp  procedural  and  analytical  techniques. 

Volume  III  consists  of  a  technical  supplement  illustrating 
some  of  the  methodology  appropriate  to  cost-  ffectiveness 
analysis. 
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In  order  that  this  report  of  Task  Group  IV  may  be  studied  in  context 
with  the  entire  committee  effort,  the  purpose  a.id  task  group  objectives  as 
stited  in  the  WSEIAC  Charter  are  listed  below 

Purpose 

The  purpose  of  the  Weapon  System  Effectiveness  Industry  Advisory 
Committee  is  to  provide  technical  guidance  and  assistance  to  AFSC  in  the 
development  of  a  technique  to  apprise  management  of  current  and  predicted 
weapon  system  effectiveness  at  all  phases  of  weapon  system  life. 

Task  Group  Objectives 

Task  Group  I  -  Review  present  procedures  being  used  to  establish  system 
effectiveness  requirements  and  recommend  a  method  for  arriving  at  require¬ 
ments  that  are  mission  responsive. 

Task  Group  II  -  Review  existing  documents  and  recommend  uniform  methods 
and  procedures  to  be  applied  in  predicting  and  measuring  systems  effect  . ve- 
r.c3  ch'.rirg  all  phases  of  a  weapon  system  program. 

T.isk  Group  III  -  Review  format  and  engineering  data  content  of  existing 
system  effectiveness  reports  and  recommend  uniform  procedures  for 
periodically  reporting  weapon  system  status  to  assist  all  levels  of  manage¬ 
ment  in  arriving  at  program  decisions. 

Task  Group  IV  -  Develop  a  basic  set  o£  instructions  and  procedures  for 
conducting  an  analysis  for  system  optimization  considering  effectiveness, 
time  schedules,  and  funding. 

Task  Group  V  -  Review  current  policies  and  procedures  of  other  Air  Force  , 

commands  and  develop  a  framework  for  standardizing  management  visibility 
procedures  throughout  all  Air  Force  commands. 
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ABSTRACT 


A  discussion  of  optimisation  which  amplifies  the  material  in  Volume  II, 
Section  IV  is  presented.  Optimisation  principles,  criteria  and  checklists, 
as  well  as  a  summary  of  various  applicable  techniques  is  included.  A 
series  of  six  examples  are  described  covering  a  number  of  critical  aspects 
of  cost-effectiveness  analysis  in  considerable  detail.  Treated  in  the  ex¬ 
amples  are:  (1)  Optimisation  of  effectiveness  based  on  reliability,  main¬ 
tainability,  performance,  and  cost;  (2)  Allocation  of  reliability  require¬ 
ments  among  subsystems;  (3)  Pavload  allocation  among  three  subsystems 
based  on  a  fixed  weight  constraint;  (4)  Determination  of  best  checkout 
routine  for  a  limited  pre-launch  test;  (5)  Optimisation  of  availability  for  a 
complex  system;  and  (6)  Trade-off  study  between  site  hardening  and  dis¬ 
persal  for  a  missile  system. 
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SECTION  I 


INTRODUCTION 

Volume  II  of  the  final  report  of  Task  Group  IV  discussed  cost- 
effectiveness  analysis  in  general  terms.  In  this  volume  we  shall  elaborate 
on  some  of  the  principles  set  forth  earlier.  We  shall  do  this  by  means  of 
relatively  detailed  examples  which  will  illustrate  some  of  the  uses  of  models 
during  the  Definition  and  Acquisition  Phases  of  a  system  life. 

As  noted  earlier,  the  principle  use  of  a  model  during  the  Definition 
Phase  is  as  an  aid  in  selecting  between  alternative  (competing)  system  con¬ 
figurations,  all  of  which  satisfy  the  mission  (tecnnical)  requirements  laid 
out  during  the  Conceptual  Phase,  but  which  may  have  different  costs.  As 
an  example  of  this  type  of  analysis  (EXAMPLE  A),  the  cost-effectiveness 
•  ptimizaticr.  of  the  bomb -navigation  function  of  an  aircraft  system  is 
considered.  The  trade-offs  are  assumed  to  be  restricted  to  reliability, 
maintainability  and  performance.  Two  alternative  values  exist  for  each  of 
the:;e  factors,  representing  the  only  possible  choices  between  competing 
types  of  hardware  and  support  policies.  These  alternatives  give  rise  to 
eight  compe*ing  system  configurations.  The  required  number  (N)  of  air¬ 
craft  are  dete-mined  such  that  either  of  two  system  effectiveness  criteria 
are  met.  The  choice  between  these  "equally  effective"  systems  is  then 
made  from  a  comparison  of  the  relative  costs  of  the  competing  systems. 

This  example  illustrates  cost-effectiveness  optimization  by  the  ex¬ 
haustion  of  alternatives  when  effectiveness  is  treated  as  a  constraint 
(minimum  acceptable  value  imposed  from  Conceptual  Phase).  An  important 
point  brought  out  by  the  example  is  the  effect  of  a  slight  relaxation  (critical 
review)  of  the  quantitative  value  of  the  effectiveness  constraint. 

The  principal  role  of  models  during  the  Acquisition  Phase  lies  in  the 
areas  of  internal  optimization  of  the  system.  An  early  consideration  in 
such  an  optimization  is  the  allocation  of  the  quantitative  mission 
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requirements  among  the  subsystems  of  the  system.  Model  application  m 
this  area  is  illustrated  by  reliability  allocation  (EXAMPLE  B)  and  op  1  mum 
payload  weight  allocation  (EXAMPLE  C). 

The  technique  for  subsystem  reliability  allocation  considered  here  re¬ 
lates  system  configuration  and  state-of-the-art  factors  for  each  subsystem 
to  the  mission  reliability  constraints. 

Payload  allocation  among  three  subsystems,  subject  to  a  fixed  weight 
constraint,  is  treated  as  a  two  stage  allocation  process  (dynamic  program¬ 
ming).  The  first  stage  determines  the  optimum  trade-off  between  warhead 
(lethal  radius)  and  guidance  (accuracy).  The  second  stage  determines  the 
optimum  division  between  penetration  aids  and  the  previously  determined 
optimum  mix  of  warhead  and  guidance  weights.  The  measure  of  effective¬ 
ness  used  in  this  allocation  la  "the  probability  that  a  missile  destroys  a 
particular  defended  point  target;  given  that  it  is  delivered  to  the  target  area 
in  a  non-failed  condition.  "  Thus,  this  example  illusti  .'.tea  a  method  for 
optimizing  system  capability,  as  opposed  to  availability  or  dependability. 

Later  in  the  Acquisition  Phase  an  increasing  amount  of  attention  is 
devoted  I,  questions  of  system  support  and  deployment.  Two  examples  of 
model  use  are  given  in  the  context  of  support  optimization.  The  first 
(EXAMPL  E  D)  treats  tlau  problem  of  determining  the  bert  choice  oi  test 
content  of  a  time  limited  prelaunch  checkout.  Cost  considerations  are 
introduced  as  a  final  aid  in  selecting  between  checkout  formats. 

The  second  example  of  support  optimization  (EXAMPLE  E)  treats  the 
availability  aspect  of  system  effective  ex  3  in  some  detail.  The  principal 
parameters  of  availability  are  defined  and  given  explicit  relation  for  a 
calendar  scheduled  checkout  model  that  considers  the  checkout  duration  as 
system  down  time.  Approximation  formulae  for  the  relation  between  maxi¬ 
mum  (optimum)  availability  and  system  parameters  are  derived.  The 
questions  of  maintenance  resource  limitation  and  parameter  estimation  are 
briefly  treated. 

The  last  example  treats  the  question  of  missile  deployment  (EXAMPLE 
F)  from  the  point  of  view  of  a  trade-off  between  site  hardening  and  dispersal. 
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The  meacure  of  system  effectiveness  used  here  is  the  probability  of  site 
survival  for  one  or  more  strikes  against  a  weapon  complex  of  seveial  sites 
separated  by  distances  of  lest;  than  two  lethal  radii.  The  technique  present, 
ed  is  partially  graphical  and  partially  analytical.  The  graphical  portion 
consists  of  a  simple  square  counting  technique  based  on  a  transparent  pro¬ 
bability  grid  overlay  of  the  geographic  dispersion  of  the  weapon  complex 
The  probabilities  determined  in  thir  way  are  treated  as  the  transition  pro¬ 
babilities  which  relate  the  weapon  complex  condition  on  a  given  strike  to 
the  condition  which  will  (probably)  exist  on  a  succeeding  strike.  The  re¬ 
sulting  Markov  chain  of  events  is  handled  by  matrix  notation. 
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SECTION  II 


OPTIMISATION  PRINCIPLES 

1.  0  INTRODUCTION 

The  optimization  of  system  effectiveness  is  a  desirable  goal 
throughout  a  system's  life  cycle,  from  the  research  and  development  stages 
through  operational  use.  An  ever-present  obstacle  to  this  goal  is  the  prob¬ 
lem  of  translating  the  general  phrase  "optimization  of  system  effectiveness" 
into  more  precise  terms.  Since  system  effectiveness  is  a  measure  of  the 
system's  ability  to  accomplish  its  mission,  it  mu3t  first  be  determined  how 
the  system  will  be  constituted,  what  its  mission  or  objective  will  be,  and 
what  particular  form  the  system  effectiveness  measure  will  assume.  Asso¬ 
ciated  with  system  effectiveness  are  techniques,  instrumentalities,  man¬ 
power,  dollars,  time,  and  other  factors  that  determine  the  value  of  this 
measure.  The  term  "resources"  is  used  tc  represent  these  factors. 

The  optimization  process,  then,  is  essentially  one  of  achieving  a  com¬ 
bination  of  resource  use  and  attained  effectiveness  that  is,  by  some  criterion, 
best.  This  c  iterion  is  usually  expressed  in  terms  of  cost,  which  generally 
represents  expenditure  not  only  of  dollars,  but  also  of  time,  manpower,  and 
material.  The  process  involves  what  is  now  commonly  called  cost- 
effectiveness  analysis. 

Thus,  given  ar>  appropriate  form  for  the  effectiveness  measure,  the 
optimum  system  might  be  (1)  one  that  meets  or  exceeds  a  particular  value 
of  effectiveness  for  minimum  coal,  or  (2)  one  that  attains  a  maximum  value 
of  effectiveness  for  a  given  total  cost,  or  (3)  some  type  of  combination  of 
(1)  and  (2)  in  which  the  costs,  and  possibly  the  effectiveness  measure,  can 
be  considered  as  vector  quantities. 

After  the  criterion  for  optimization  has  been  established,  the  second 
problem  that  must  be  faced  is  the  representation  of  effectiveness  as  some 
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References  1  and  2  provide  excellent  introductions  to  the  types  of  system 
analysis  considered  in  this  section. 
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function  of  the  resources,  and  the  resources  as  some  function  of  costs. 
Thus,  if  we  want  to  maximize  effectiveness  for  a  given  cost,  and  if  some  of 
the  resources  are  constrained,  the  mathematical  form  of  the  optimization 
problem  would  bt  as  shown  below.  Let 

E  =  system  effectiveness. 

C  =  total  cost  constraint 

r.  =  amount  of  i1*1  resource 
i  t  h 

c.(r  )  =  cost  of  r.  units  of  x  resource. 

1  1  l 

Maximize 

E  =  F(rl-  r2 . rn>* 

subject  to  the  following  constraints: 

r.  >  0,  i  =  1,  2 . n 

g[cl<r,).  c,  (rj),  ...  cn(rn)]<C 


( 


r.  <  R. 

M  *i 


Note  that  the  term  resources  is  used  in  a  very  general  sense.  A  re¬ 
source  might  be  the  number  of  maintenance  men  available,  or  the  electrical 
stresses  on  parts  as  influenced  by  the  design  or  the  training  of  operators. 

The  function  F,  then,  is  the  mathematical  model  that  expresses  effectiveness 
as  a  function  of  these  resource  variables,  and  the  functions  g  and  c. 
represent  the  cost  model  relating  these  variables  to  total  system  cost. 

The  mathematical  formulation  of  the  optimization  leads  to  the  third 
problem:  selecting  the  technique  for  arriving  at  the  optimum  system.  The 
techniques  range  from  the  trial -and-error  routine  of  examining  every 
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possible  approach,  to  more  sophisticated  trial -and -error  routines  (such  as 
those  used  in  linear  and  dynamic  programming),  to  extremely  complicated 
nathematical  techniques  which,  for  complex  problems,  may  only  guarantee 
near  or  local  optimum  solutions. 

Each  of  the  thre?  areas  mentioned  --  criterion  formulation,  rrooeling, 
and  application  of  the  optimization  technique  --  is  discussed  in  more  detail 
in  the  remainder  of  this  section.  The  general  approach  to  the  optimization 
process  is  summarized  in  Figure  1,  in  which  it  is  seen  that  optimization 
can  be  considered  a  feedback  loop  consisting  of  the  following  steps: 

(1)  "Designing"  many  systems  that  satisfy  the  operational 
requirements  and  constraints 

(2)  Computing  resultant  values  of  effectiveness  and  resource 
use. 

(3)  Evaluating  these  results  and  making  generalizations  con¬ 
cerning  appropriate  combinations  of  design  and  support 
factors,  which  are  then  re -fed  into  the  model  to  'orm  the 
feedback  loop. 

2.0  OPTIMIZATION  CRITERION 

Tn  defining  an  optimizing  criterion,  the  system  analyst  is  faced  with  a 
problem  similar  to  that  of  putting  in  precise,  quantifiable  terms  the  rules 
or  criteria  ;  -  ehcccin*  U.v  "  i/cui"  painting  or  "best"  automobile.  These 
examples  do  h  ve  quantifiable  characteristics,  such  as  the  size  of  the 
painting  or  coet  of  the  automobile:  however,  artistic  judgment  and  user 
experience,  respectively,  are  factors  in  the  final  choice.  In  th»  same  sense, 
the  choice  of  the  best  system  is  greatly  influenced  by  the  use  of  good 
engineering,  economic,  and  operational  judgment. 

It  is  most  important,  however,  that  the  optimizing  criterion  be  defined 
to  the  maximum  extent  possible,  for  the  following  reasons: 

(1)  The  inputs  provided  to  the  analyst  through  use  of  the  criterion 
can  reduce  the  size  of  the  problem  to  a  point  where  a  judicious 
choice  can  be  made. 

(2)  Defining  a  criterion  forces  the  analyst  to  examine  all  possible 
alternatives  in  an  objective  manner  so  that  the  criterion  can 
be  adapted  to  mathematical  representation  and  analysis. 


6 


FIGURE  J.  FLOW  DIAGRAM  FOR  A  GENERAL  OPTIMIZATION  PROCESS 

7 

i 


"WiaiKtow' 


(3)  It  is  easier  to  incorporate  tho  ideas  and  experience  of 
others  if  a  formal  basis  for  optimization  is  established- 

(4)  The  (partial)  basis  for  final  choice  is  in  precise,  quanti¬ 
fiable  terms  and  can  therefore  be  reviewed  and  revised, 
and  can  provide  inputs  to  a  learning  proceed  for  future 
optimization  problems. 

When  a  criterion  for  optimization  is  being  formulated,  the  system  and 
the  boundaries  must  be  explicitly  defined.  This  definition  will  influence 
the  choice  of  r.arameters  in  the  optimization  model.  The  purchaser  of  a 
new  automobile,  for  example,  may  or  may  not  consider  the  service  policies 
of  the  manufacturer  and  dealer.  If  he  does,  the  system  is  both  the  automo¬ 
bile  and  service  policies;  if  he  does  not,  the  system  is  only  the  automobile. 
In  attempting  to  optimize  a  weapon  system  such  as  a  bombsr,  the  analyst 
has  to  consider  whether  the  system  is  to  be  defined  a»  a  single  bomber,  a 
squadron  of  bombers,  or  the  complete  bomber  fleet.  It  is  possible  that 
optimizing  with  respect  to  a  single  plane  (a  sub -optimization)  may  not  yield 
the  optimum  "squadron"system,  which  may  not,  in  turn  give  a  force-wide 
optimum. 

Aj  part  of  the  system-definition  process,  the  analyst  alt  o  determines 
the  fixed  and  variable  factors  pertinent  to  the  system.  This  task  requires 
a  preliminary  analysis,  since  consideration  of  all  possible  alternatives 
will  usually  lead  to  problems  of  unmanageable  size.  Some  factors  may  be 
considered  fixed  if  results  of  previous  analyses,  perhaps  sub -optimizations, 
indicate  the  values  that  have  attained  the  best  results  In  the  past.  The 
maintenance  trouble-shooting  routine,  for  example,  might  normally  be 
considered  as  a  variable  factor,  but  past  research  in  this  area  may  be  used 
»  •  select  a  particular  routine  applicable  to  the  system  under  study,  or 
perhaps  to  restrict  the  range  to  several  alternatives. 

Once  the  mission  profile  is  dsfined,  consideration  can  be  given  to  the 
physical  and  economic  limitations  that  will  have  to  be  Imposed.  These 
limitations  are  based  on  requirements  and  availabilities,  and  may  involve 
such  factors  as  minimum  system  output,  maximum  reliability,  maximum 
development  time  maximum  weight  and  volume,  and  type  and  number  of 
support  and  operational  personnel.  Through  such  consideration  and 
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envelope  of  design,  development,  operational,  and  support  alternatives  can 
be  established  in  such  a  way  that  each  overall  configuration  within  the  enve¬ 
lope  will  meet  physical  and  economic  limitations  as  well  as  minimum 
performance  goals. 

Now  the  analyst  must  select  a  decision  criterion  bv  specifying  the  types 
of  effectiveness  and  cost  parameters  to  be  investigated  and  by  assigning 
numerical  values  where  required.  Such  considerations  have  been  treated 
previously,  in  which  various  types  of  effectiveness  measures  are  discussed 
in  conjunction  with  system  and  mission  types.  As  indicated  previously,  the 
choice  of  objectives  and  criteria  is  perhaps  the  most  difficult  task  in  system 
effectiveness  optimization.  It  is  expected,  however,  that  current  research 
in  the  optimizing  of  system  effectiveness  will  develop  theory  and  accumulate 
experience  to  help  overcome  some  of  the  difficulties  of  this  task. 

It  would  be  impossible  to  establ  ah  rigid  ground  rules  or  procedures  for 
formulating  a  criterion  for  optimizing  system  effectiveness.  The  answers 
u>  the  following  two  basic  questibns,  however,  will  provide  a  great  deal  of 
insight  for  such  formulation: 

(1)  Why  is  the  system  being  developed? 

(2)  What  physical  and  economic  limitations  exist? 

The  answer  to  the  first  question  essentially  defines  the  mission  profile 
of  the  system.  Where  possible,  the  definition  should  be  translated  into 
quantitative  parameters  --  a  difficult  task  in  most  cases.  A  performance 
measure  such  as  kill  •probability  for  a  SAC  bomber  may  he  assignable,  but 
the  bomber  may  also  have  a  mission  to  act  as  a  deterrent  --  a  measure 
that  is  difficult  to  quantify  in  a  completely  satisfactory  manner.  It  is  fo: 
this  type  of  multi -mission  case  that  judgment  will  become  especially  impor¬ 
tant.  Even  if  quantitative  requirements  can  be  placed  on  all  mission  types, 
weighting  factors  would  have  to  be  introduced  to  quantify  the  relative  impor¬ 
tance  of  each  mission. 

Factors  that  have  relatively  little  impact  on  overall  effectiveness  or  cost 
can  be  considered  to  be  fixed  or,  possibly,  can  be  ignored.  There  is,  of 
course,  a  risk  involved  if  factors  chosen  to  be  fixed  or  unimportant  would 
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have  hod  a  significant  effect  if  they  had  been  allowed  to  vary.  Factors  the* 
fall  in  this  "gray  area"  may  have  constraints  imposed  upon  them  m  such  a 
manner  that  the  more  detailed  analysis  to  be  performed  in  the  optimization 
p  ocesa  will  indicate  final  disposition.  For  example,  if  a  questionable 
factor  migh<  have  a  monotonic  influence  on  effectiveness,  consideration  of 
only  extreme  values  might  be  all  that  is  necessary  to  determine  ho  signifi¬ 
cance  of  this  influence. 

It  is  important  that  factors  selection,  variability,  and  the  final  choice  of 
system  definition  be  clearly  indicated  so  that  the  icon'  of  the  optimization 
process  will  be  known  and  areas  for  possible  modification  of  the  formal 
mathematical  solution  will  be  made  explicit. 

3.0  MODELING 

A  system  model  is  essentially  a  mathematical,  logical,  or  physical 
representation  of  the  interdependencies  between  the  objectives  and  the 
resources  associated  with  the  system  and  its  use.  For  coaling  with  the 
effectiveness  of  complex  systems,  the  model  is  usuall)  in  the  form  of 
mathematical  equations  (mathematical  model)  or  computer  programs  for 
simulating  system  operation  (simulation  model),  or  both. 

On  the  assumption  that  a  set  of  system  requirements  has  been  tran'i 
lated  into  au  optimization  criterion,  the  model  builder  is  required,  mini¬ 
mally,  to  construct  a  model  that  will  enable  quantification  of  the  crit.^al 
effectiveness  and  cost  parameters  as  a  function  of  the  resource  variat>s. 

The  overall  cost-effectiveness  model  is  usually  one  that  consists  of 
several  sub-models,  each  of  which  may  be  based  on  models  at  still  lower 
levels.  Figure  2  indicates  one  means  for  sub-model  classification.  It 
should  be  noted  that  there  arc  many  other  schemes  for  classifying  models. 

For  example,  one  classification  scheme  considers  a  value  model,  cost  model, 

t  .... 

technical  model,  operational  model,  and  strategic  model.  (See  Reference  3. ) 

There  is,  naturally,  a  great  deal  of  interaction  among  the  sub -models, 
and  model  integration  is  required  in  the  same  sense  that  system  integration 
is  required. 
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A  SUB-MODri.  CLASSIFICATION  SCHEME 


Consii  ting  s'lh-mo'N  3  (inti  integrating  them  into  an  overall  mode’) 
i'.  for  moat  '-al  woil  situations,  still  me  -e  of  an  art  than  a  science, 
rgely  because  .  lidity  of  the  model  cannot  be  tested  through  controlled 

experimentation  mu*  the  collaboration  cf  people  with  wide  experience  in 
(he  areas  of  •  _ncern  is  an  important  requirement. 

Sect.ons  3.  1  to  3.  6  discu.s  some  of  the  more  important  considerat'ons 
for  designing  opllmizai’on  models. 

3.  1  Aseumption.- 

All  assumpt'rus  required  for  the  model  should  be  explicit!'  seated  and, 
if  possible,  "utiported  by  factual  evidence.  If  no  3uch  evidence  xists,  it  is 
advisable  to  state  the  reason  for  the  assumption;  o.  g.,  matlvsn  .tl  -al  sim¬ 
plicity  ot  consensus  of  opinion,  in  order  to  indicate  the  deg.  •  to  which  the 
assur  ptions  will  require  further  justification  and  to  pinpoint  the  areas  in 
wh'cti  errors  might  be  introduced. 

3.  2  Adequacy 

A  model  must  be  adequate  in  the  sense  that  all  major  variables  to  which 
the  solution  i  '  sensitive  arc  quantitatively  considered  where  possible.  Many 
of  these  variables  will  have  been  preselected.  Through  manipulation  of  the 
model,  some  of  the  variables  may  be  excluded  or  restricted,  and  others 
may  be  introduced.  Non-quantifiable  variables  must  be  accounted  for  by 
modification  of  the  solution  rather  than  by  direct  incorporation  into  the 
model.  In  this  sense  they  are  quantifiable. 

3.  3  Representativeness 

Although  no  model  can  completely  duplicate  the  "real  world,  "  it  is  re¬ 
quired  that  the  model  reasonably  represent  the  true  situation.  For  complex 
problems,  this  may  be  possible  only  for  sub-parts  of  the  problem,  which 
must  be  pieced  together  througn  appropriate  modeling  techniques.  As  an 
example,  analytic  representation  may  be  possible  for  various  phases  of  a 
complex  maintenance  activity.  The  outputs  from  these  analyses  may  then 
be  uued  as  inputs  to  a  simulation  procedure  for  modeling  the  complete  main¬ 
tenance  process. 
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3  4  Uncertainty 

The  various  types  of  uncertainties  involved  in  the  problem  cannot  be 
ignored,  nor  can  they  be  "assumed"  oat;  they  must  be  faced  squarely.  Tuere 
.nay  be  technological  uncertainties  involved  with  some  of  the  system  site 
natives,  operational  uncertainties  involved  with  planning  and  carrying  out  the 
mission,  uncertainties  about  enemy  strategy  and  action,  and  statistical 
uncertainties  governed  by  the  laws  of  chance.  The  simplest  approach  ii  to 
make  "best  guesses,"  but  this  may  lead  to  disastrous  results,  since  thu 
probability  of  guessing  correctly  for  every  uncertainty  is  quite  small.  For 
cases  involving  statistical  uncertainty  (risk),  functions -of-random -variables 
theory  or  such  procedures  as  Monte  Carlo  techniques  may  be  used  For  the 
other  types  of  uncertainties,  the  general  approach  is  to  examine  ull  major 
contingencies  and  compute  resultant  cost-effectiveness  parameters.  The 
optimisation  criterion,  then,  must  be  adaptable  for  use  in  the  evaluation  of 
the  set  of  cost-effectiveness  results.  The  developments  of  decision  theory 
and  game  theory  become  most  applicable  in  the  selectit.a  of  a  decision  model 
ui  these  cases,  since  different  alternatives  may  be  best  for  different 
contingencies. 

3.  5  P  ita 

The  availability  of  relevant  data  plays  an  important  role  in  the  develop¬ 
ment  and  application  of  a  model.  Data  are  required  to  support  assumptions, 
select  alternatives,  and  define  constraints,  as  well  as  to  define  the  cost  and 
jffectiveness  constants  in  the  proposed  model.  Since  missing  data  may  pra- 
v*nt  valid  modal  application,  the  model  builder  should  investigate  this 
possibility  early  in  the  model  development  stages  and  plan  to  obtain  missing 
data  or  adjust  the  model  accordingly.  If  a  great  expenditure  of  time  and 
money  is  required  to  obtain  the  necessary  data,  the  analyst  may  be  forced  to 
weigh  the  risks  of  using  what  is  available  (and  making  neceaaary  assump¬ 
tions)  against  the  value  received  in  return  for  the  costs  of  the  data  -collection 
and  analysis  effort. 

3.6  Validity 

The  final  test  of  the  model  Is  whsther  or  not  it  yields  the  best  system. 


13 


Unfortunately,  this  determination  can  never  be  accomplished  in  th^  "real 
world."  However,  certain  questions  will  disclose  weaknesses  in  ihe  model 
that  can  be  corrected: 

(1)  Consistency  -  are  results  consistent  when  major 

parameters  are  varied? 

(2)  Sensitivity  -  do  input -variable  changes  result  in 

output  changes  that  are  consistent 
with  expectations  ? 

(3)  Plausibility  -  are  results  plausible  for  spec:al 

cases  where  prior  information  exists? 

(4)  Criticality  -  do  minor  changes  in  assumptions 

result  in  major  changes  in  the  results? 

(5)  Workability  -  does  the  model  require  inputs  or 

computational  capabilities'  that  are 
not  av»;,able  within  the  research 
bounds  ? 

(6)  Suitability  -  is  the  model  consistent  with  the 

objectives;  i.  e.,  will  it  answer  he 
right  questions? 

4.0  OPTIMIZATION  TECHNIQUES  -1 

Ai  in'  ated  in  Figure  1,  the  technique  for  optimization  essentially 
inv  ives  the  application  of  effectiveness  and  cost  models  to  all  feasible 
designs  selection  of  the  desivn  which,  according  to  the  criterion,  is 
optimum. 

While  this  approach  is  conceptually  simple,  its  implementation  is 
virtually  impossible,  except  for  the  most  simple  problems.  Consider  a 
problem  involving  fifteen  variables,  each  of  which  may  take  one  or  two 
possible  values.  More  than  32,000  possible  system  designs  would  have  ti 
be  considered,  a  task  that  would  tax  even  the  largest  of  the  available  coir  - 
puters. 


2  / 

—  The  differentiation  between  ’model"  and  "technique"  is  sot  always  clear. 
This  is,  however,  primarily  a  semantic  problem.  As  discussed  here,  a 
model  may  embody  the  technique  for  optimization,  although  the  converse 
is  not  true. 


Techniques  are  therefore  needed  to  reduce  the  amount  of  mathematics 
and  computation  to  a  size  reasonable  for  computer,  geometrical,  or  even 
hand  solution.  In  a  eense,  these  techniques  are  „u,;histicated  trial -and- 
error  routines.  Some  of  the  more  commonly  used  techniques,  or  fields 
from  which  such  techniques  are  derived,  are  listed  in  Table  I.  The  list  is 
by  no  means  complete.  References  4  and  5  are  recent  publications  on 
optimization  to  which  the  reader  is  referred  for  a  description  of  these  and 
other  techniques  and  their  application  to  selected  problems. 

5.0  INTERPRETATION 

As  indicated  previously,  a  model  of  a  complex  process  is  usually 
incomplete  because  of  uncertainties,  non-quaniitative  factors,  inadequate 
data,  and  inadequate  consideration  of  the  effects  of  the  process  on  systems 
and  operations  at  higher  echelons.  In  such  cases  the  results  of  the  optimi¬ 
zation  process  can  only  indicate  the  best  system  within  the  simplifications, 
assumptions,  restrictions,  and  .omissions  required  to  circumvent  the  voids. 

The  effects  of  these  circumventions  must  then  be  evaluated  through 
iorr''  ?yn«*  of  model  feedback  procedure  which,  on  the  basis  of  the  attained 
r>  aultb,  may  reveal  some  critical  deficiencies  that  can  be  rectified 

Ho-  ever,  even  the  most  modern  mathematical  techniques  and  computers 
will  yield  only  partial  analytic  solutions,  mainly  because  of  the  uncertainties 
These  uncertainties  often  exist  in  the  overall  objective  and,  when  broader 
contexts  are  being  considered,  it  may  be  necessary  to  exair-ae  alternative 
objectives.  We  thus  have  the  enlarged  problem  of  first  selecting  the  opti¬ 
mum  mission  and  the  associated  optimum  set  of  constraints. 

The  optimization  process,  therefore,  provides  the  framework  for  a 
final  decision.  If  the  process  is  based  on  a  correct  formulation  of  the  prob¬ 
lem  and  application  of  a  reasonable  model,  the  decision  can  be  critically 
evaluated  and  suitably  modified.  However,  because  of  inherent  limitations 
to  a  strictly  analytical  approach,  the  experience  and  judgment  of  management 
ordinarily  inherit  responsibility  for  the  final  choice. 
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TABLE  I  | 

PARTIAL  LIST  OF  TECHNIQUES  FOR  OPTIMIZATION  | 

T 

A  , 

Mathematical  Technique* 

Birth  and  death  processes 

Calculus  of  finite  differences 

Calculus  of  variations 

Gradient  theory 

Numerical  approximation  methods 

Symbolic  logic 

Theory  of  linear  integrals 

Theory  of  maximum  and  minimum 

II. 

Statistical  Techniques 

Bayesian  analysis 

Decision  theory 

Experimental  design 

Information  theory 

Method  of  steepest  ascent 

Stochastic  processes 

in. 

Programming  Techniques 

Dynamic  programming 

Linear  programming 

Nonlinear  programming 

IV. 

Other  Operations  Research  Techniques 

Gaming  theory 

Monte  Carlo  techniques  __ 

Queuing  theory 
'Renewal  theory 

Search  theory 

Sensitivity  testing 

Signal  flow  graphs 

Simulation  . 

Value  theory  1 
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SECTION  III 


EXAMPLES  RELATING  TO  COST-EFFECTIVENESS  OPTIMIZATION 

In  this  Section  six  examples  are  presented  in  detail  relative  to  cost- 
effectiveness  optimization,  a.A  follows: 

EXAMPLE  A:  Aircraft  System  Optimization 

EXAMPLE  B:  Reliability  Allocation 

EXAMPLE  C:  Ballistic  Missile  Payload  Allocation 

EXAMPLE  D:  Optimizing  a  Prelaunch  Checkout 

EXAMPLE  E:  Missile  Availability 

EXAMPLE  F:  A  Vulnerability  Model  for  Weapon  Sites 
with  Interdependent  Elements 
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EXAMPLE  A 

AIRCRAFT  SYSTEM  OPTIMIZATION 
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I 


ABSTRACT 


A  system  cost-effectiveness  model  is  developed  for  an  Air  Force 
training  base  at  which  daily  bomber  training  flights  are  made.  In  the 
event  of  enemy  attack,  the  base  bomber  force  is  as*  uned  to  targets. 
The  objective  of  the  example  is  to  illustrate  the  optimisation  of  the 
bomber  effectiveness  by  trading  off  reliability,  maintainability,  per¬ 
formance  and  cost  factors.  The  system  effectiveness  model  is  devel¬ 
oped  along  the  mathematical  lines  presented  by  Task  Group  II  in 
Volume  II  of  the  final  report.  Optimization  is  accomplished  by  com¬ 
puting  and  comparing  the  costs  of  eight  possible  procurement  and 
support  policies  in  terms  of  two  alternative  figures  of  merit: 

(1)  For  each  target,  there  will  be  a  0.  95  probability  that  at 

least  one  of  the  attacking  aircraft  will  successfully  accom¬ 
plish  the  bombing  run. 

(ii)  '  here  will  be  an  average  success  probability  of  0.95  for  all 
assigned  targets. 

A  significant  aspect  of  this  example  is  its  illustration  of  the  need  for 
re-evaluating  the  criterion  for  optimisation  in  terms  of  the  jalized 
output  of  the  evaluation  effort. 
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1.0 


INTRODUCTION 


1/ 

This  example  discusses  an  optimisation  problem  that  illuctrates 
some  of  the  concepts  discussed  in  the  main  body  of  the  report.  An  Air 
Force  training  base,  at  which  daily  bomber  training  flights  are  made,  will 
be  considered.  In  the  event  of  enemy  attack,  the  bomber  force  assigned  to 
this  base  has  the  responsibility  of  attacking  assigned  targets.  The  objec¬ 
tive  is  to  optimize  the  bomber  effectiveness  by  trading  off  reliability, 
maintainability,  performance,  and  cost  factors. 

For  simplicity  of  illustration,  only  the  Bomb/Nav  system  of  the 
bomber  will  be  considered  in  the  determination  of  bomber  effectiveness. 
Several  simplifying  conditions  will  also  be  assumed  for  the  purpose  of 
avoiding  the  complex  mathematical  and  operational  procedures  that  may 
tend  to  obscure  the  objective  of  the  example. 

2.0  BASE  CONDITIONS 

Th«  following  operating  conditions  at  the  base  are  assumed: 

(11  Aircraft  of  the  allocated  force  are  scheduled  for  eight-hour 
training  flights  ev“i*y  other  day.  Thus,  exceDt  for  grounded 
aircraft,  half  of  the  aircraft  on  the  base  are  scheduled  to  fly 
on  any  given  day. 

(2)  The  takeoff  times  of  the  aivciaft  scheduled  to  fly  are  equally 
distributed  over  the  period  0  to  1600  hours,  and  the  landing 
times  are  equally  distributed  over  the  period  0800  to  2400 _ 
hours.  It  is  assumed  that  a'  particular  aircraft  takes  off  and 
lands  at  the  same  times  on  every  scheduled  flying  day. 


— ^  This  example  was  developed  jointly  by  AFJNC  Research  Corporation 
and  John  Danish,  Directorate  of  Strategic  and  Tactical  Systems  Engineering, 
Wright-Patterson  AFB,  Ohio,  and  originally  appeared  in  the  report 
"System  Effectiveness:  Concepts  and  Analytical  Techniques,  "  ARINC 
Research  Publication  419,  January  1964. 
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(i)  At  the  time  of  scheduled  takeoff,  the  Bomh/Nav  system  and  tne 
aircraft  are  in  one  of  four  states: 


System  has  no  malfunction; 
aircraft  not  grounded 
System  has  undetected  malfunction; 
aircraft  not  grounded 
S^  System  has  detected  malfunction; 

aircraft  not  grounded 
S4  Aircraft  is  grounded. 

(4)  Aircraft  in  States  Sj  and  S£  will  take  off  on  training  flights  as 
scheduled.  Aircraft  in  States  S3  and  S^  will  not  take  off  on 
training  flights.  If  an  alert  occurs,  however,  aircraft  in 
State  S3  will  be  used. 

3.0  OPTIMIZATION  CRITERION 

It  is  assumed  that  the  planes  under  consideration  are  used  primarily 
for  training  purposes,  but  that  their  bombing  assignment  (perhaps  to 
secondary  targets)  in  the  event  of  enemy  attack  is  a  significant  factor  in 
optimization.  Therefore,  optimization  will  be  performed  with  respect  to 
actual  bombing  runs.  Although  this  approach  may  not  lead  to  the  optimum 
training  effectiveness,  it  is  assumed  that,  for  the  alternatives  considered, 
the  cost  and  effectiveness  of  training  vary  over  acceptable  ranges  and  need 
not  be  explicitly  considered  unless  several  of  the  alternatives  are  candidates 
for  the  optimum  policy. 

Two  optimization  criteria  will  be  considered  in  this  example,  to 
indicate  how  the  choice  of  criteria  can  affect  the  final  decision: 

Criterion  I  -  For  each  target,  there  will  be  a  0.95  probability 
that  at  least  one  of  the  attacking  aircraft  will 
successfully  accomplish  the  bombing  run. 

Criterion  II  -  There  will  be  an  average  success  probability  of 
0.  9r>  for  all  assigned  targets. 
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For  either  Criterion  I  or  Criterion  II  the  probability  of  success, 
which  we  shall  call  strategic  effectivenens,  is  a  function  of  the  number  of 
aircraft  assigned  to  the  targets  and  the  system  effectiveness  :~ch  n 5. r- 
craft  (for  this  example,  the  Bomb/Nav  system  specifically).  It  is  therefore 
necessary  to  choose  the  force  composition,  in  terms  of  number  of  planes 
and  Bomb/Nav  system  effectiveness,  that  will  meet  one  of  the  criteria  at 
minimum  cost. 


4.0  SYSTEM  ALTERNATIVES 

With  only  the  Bomb/Nav  system  being  considered  explicitly,  it  is 
assumed  that  alternatives  exist  with  respect  to  mission  reliability  and 
operational  readiness  (availability).  It  is  further  stipulated  that,  in  case  of 
failure  of  the  Bomb/Nav  system,  a  secondary  mode  of  operation  is  available, 
but  that  it  has  a  greatly  reduced  design  capability.  Since  the  investment 
cost  of  the  planes  is  always  greater  than  the  cost  of  the  reliability  and  main¬ 
tenance  alternatives,  the  approach  will  be  to  determine  the  minimum  number 
of  planes  needed  to  meet  the  strategic  effectiveness  requirement  for  each 
alternative,  and  then  to  choose  the  policy  with  the  minimum  overall  cost. 


To  simplify  the  problem  somewhat,  only  a  discrete  number  of 
alternadves  will  be  considered.  These  alternatives  are  obtained  from  the 
following  factors: 


(1)  Reliability:  Two  values  of  system  failure  rate  are  possible- - 
0.  10  and  0.  05  failures  per  hour.  On  the  assumption  that  these 
rates  are  constant  over  the  mission  length,  t^,  ;he  reliability 
alternatives  are 


Kj  =  e-<°*  1C*m 
R2  .  e-<0’  05*m 


(2)  Maintenance:  'Two  overall  maintenance  policies  and  procedures 
are  possible.  They  involve  such  factors  as  training,  admini¬ 
stration,  logistics,  manpower,  and  equipment.  They  lead  to 
two  possible  maintenance -time  distributions,  which  are 
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identified  as  Tj  and  T-,  in  Figure  1.  Maintenance  time  is 
measured  from  the  time  the  aircraft  lands  to  the  time  the 
repair  action  is  completed, 

(3)  Maintenance  Efficiency  :  The  probability  that  i  rr  'function  in 
the  Bornb/Nav  system  is  actually  repaired,  give  ompleted 
maintenance  action,  is  defined  as  maintenance  efficiency.  It  is 
a  function  of  personnel  selection,  training,  and  test  equipment, 
the  combination  of  which  is  assumed  to  be  largely  independent 
of  the  factors  affecting  maintenance  time.  Two  values  are 
assumed: 

M  j  -  0. 6 

M2  =  0.  8. 

All  possible  combinations  of  the  alternatives  for  the  above  three 
factors  make  eight  possible  policies,  or  system  alternatives,  available  to 
the  decision  maker.  They  are  as  follows: 


Policy 

Alternatives 

Policy 

Alternatives 

1 

R1  T1M1 

5 

R2  Tj  Mj 

2 

R1T1M2 

6 

r2  Tj  m2 

3 

Pvj  r2  Mj 

7 

R2  T2  Mj 

4 

R*J  T2  M2 

-8— 

R2  T2  M2 

5.°  METHOD  OF  SOLUTION 

By  a  slight  modification,  the  basic  framework  for  art  effectiveness 
model  described  in  Volume  II  of  Task  Group  II  can  be  used  to  deternvne  t>  e 
effectiveness  of  the  system  alternatives.  In  order  to  meet  Criterion  I  or 
Criterion  II,  the  required  number  of  planes  can  be  determined  by  a  model 
that  relates  system  effectiveness  to  strategic  effectiveness.  A  mst  model 
applied  to  each  of  the  eight  system  alternatives  may  then  be  used  to  deter¬ 
mine  the  optimum  configuration. 
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POSSIBLE  DISTRIBU 


5.  1  System  Effectiveness  Model 


5.  1.  1  State -Readiness  (Availability)  Vector 
State  readiness  will  be  determined  at  the  latest  possible  calendar 
time  a  plane  can  lake  off  and  still  meet  mission  requi:  ements.  This  time 
will  be  the  time  of  alert,  z,  plus  h  hours,  and  it  will  be  called  the  strike 
takeofi  time,  Z.  Three  syste  .a- readiness  states  at  Z  arc  possible: 

Readiness  State  1  -  Aircraft  is  not  grounded  and  Bomb/ftav 
system  h.?<;  ro  mMfuretions, 

Readiness  State  2  -  Aircraft  is  not  grounded  and  domb/N'av 
system  has  a  malfunction. 

Readiness  State  3  -  Aircraft  is  grounded. 

If  a.  =  probability,  system  is  in  State  i,  tb*  state  -readiness 
(availability)  vector  is 

X  =  [al  a2  a3] 


5.1.2  Mission-Readiness  Matrix 


It  is  assumed  that  a  system  in  Readiness  State  1  or  2  will  be  used, 
while  a  system  in  State  3  cannot  be  used.  The  mission-readiness  matrix 
is  th<  n 

1.0  0  0 

jy]  =  o  i.o  o  * 

0  0  0 

5.  1.  3  State -Transition  dependability)  Matrix 


If  R  represents  the  reliability  of  the  Bomb/Nav  system  for  the 
specified  mission  length,  the  state -transition  (dependability)  matrix, 
assuming  aircraft  survival  and  no  inflight  repair,  given  Readiness  State 
1  or  2,  is 


(1-R) 

l 

o 


0 

0 

1 
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5.  1.4  Design-Capability  Vector 


If  c.  represents  the  design  adequacy  of  the  system  when  it  is  in  the 
vh  * 

:  ctlt",  tuc  -capability  vector  is 


System  effectiveness  is  then  given  by 


E  =  a’  fv.*]  [d]  Z 

r  i  r 


■  [*1*2*3) 

1.0  0 

0 

R  1-S 

0 

C1 

0  1.0 

0 

0  1 

0 

c2 

0  0 

0 

0  0 

1 

,c3. 

m 

» 

- 

=  aj  RCj.+ aj  (1-R)C2  +  &2C2  •  0) 


5.  2  Strategic  Effectiveness  Model 

If  a  force  of  N  aircraft  is  assigned  to  a  target,  the  strategic 
effectiveness  of  the  force,  assuming  probabilistic  independence,  is 

S  =  1  -  (1-E)N 


for  a  system  configuration  yielding  a  system  effectiveness  value  of  E. 

1  he  required  number  of  planes  in  a  force  lor  Criterion  I  is  then 
determined  from  the  inequality 

log  (1-Sf) 


N*2 


log  (1-E) 


(2) 


where  Sf  is  the  required  strategic  effectiveness  for  each  target. 

For  Criterion  II,  if  Sg  is  the  required  average  strategic  effective¬ 
ness  for  k  targets,  the  required  number  of  planes  for  each  target,  ,  is 
determined  from  the  inequality 


<l-E)Nf]  fc  Sft  . 


(3) 
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5.  3  Cost  Model 


For  each  policy,  the  cost  (C)  can  be  considered  to  be  a  function  of 
the  reliability  (R),  maintainability  (T),  maintenance  efficiency  (M),  and 
required  number  of  aircraft  (N,:<)  associated  with  the  policy.  Hence,  the 
cost  of  the  i*^1  policy  is 

C  (policy  i)  =  f.  (R,  T,  M,  N*  ),  i  =  1,  2 .  8. 

The  details  for  quantifying  the  above  models  are  presented  in  the 
remainder  of  the  example. 

6.  0  COMPUTATIONAL  DETAILS 

6.  1  State-Readiness  (Availability) 

6.  1.  1  Operational  Sequence 

To  compute  the  state-readiness  (availability)  probability  vector.  A, 
one  must  consider  two  cases:  (1)  planes  scheduled  to  fly  on  training  mis¬ 
sions  on  the  day  of  the  alert,  a.nd  (2)  planes  not  scheduled  to  fly  on  the  day 
of  the  alert.  The  state  readiness  for  a  bombing  mission  is  a  function  of  the 
state  readiness  for  a  training  mission  (Sj,  S^,  S^,  or  S4). 

For  aircraft  scheduled  to  fly  training  missions  on  the  day  of  alert, 
Ficure  2  sl  ows  the  possible  sequences  that  will  lead  to  Readiness -State  1 
(OK),  2  (F).  or  3  (G)  for  the  bombing  mission  at  strike  takeoff  time,  Z.  It 
is  noted  that  if  an  aircraft  is  flying  on  a  training  mission  at  the  time  of  the 
alert,  it  is  considered  equivalent  to  a  grounded  aircraft.  Figure  3  shows 
the  parallel  sequences  for  aircraft  scheduled  to  fly  a  training  mission  on  the 
day  previous  to  the  day  of  the  alert. 

6.  1.  2  Training-Mission  State-Readiness  (Availability) 

The  state  probabilities  at  the  time  of  scheduled  training -flight  takeoff 
are  a  function  of  the  state  of  the  system  as  it  existed  a'ter  the  previous 
training  flight,  the  number  of  maintenance  hours  available,  the  time  spent 
on  completing  a  maintenance  action,  and  the  maintenance  eff;ciency.  To 
simplify  the  problem  it  will  be  assumed  that  the  probability  of  a  plane's 
being  grounded  is  a  constant  independent  of  these  facto***,  aince  the  factors 


30 


31 


f*1 

w 

Pi 

p 

o 

►-» 

h 


32 


S1ATUS  OF  AIRCRAFT  NORMALLY  DUE  TO  FLY  ON  THE  DAY 
PREVIOUS  TO  THE  DAY  OF  THE  ALERT 


pertain  only  to  the  Bomb/Nav  system.  A  constant  probability  is  no*  too 
unrealistic  if  the  largest  portion  of  grounded  planes  is  made  up  of  planes 
undergoing  scheduled  overhaul  or  preventive  maintenance.  An  arbitrary 
value  of  0.  10  will  be  used  for  this  probability. 

The  stes.dy-state  probabilities,  Ps-,  can  be  obtained  by  the  obser¬ 
vation  that  transition  from  one  state  at  a  scheduled  t.-vkeoff  time  to  another 
state  at  the  next  scheduled  takeoff  time  is  a  Markov  process--i.  e. ,  the 
probability  that  a  system  is  in  any  particular  state  at  a  scheduled  takeoff 
time  is  dependent  only  on  the  state  the  system  was  in  at  the  beginning  of 
the  previous  flight,  regardless  of  how  it  arrived  at  that  previous  state. 

The  following  notation  will  be  used: 

R  =  Bomb/Nav  reliability  for  an  eight-hour  training  flight 

M  =  maintenance  efficiency,  i.  e. ,  probability  that  a  repair  is 
actually  made,  given  a  completed  maintenance  action 

U  =  probability  of  a  completed  maintenance  action  before  the 
next  Bight,  given  a  malfunction  on  landing.  (U,  then,  is 
the  probability  of  a  completed  maintenance  action  within 
forty  hours,  since  takeoff  and  landing  times  are  assumed 
constant  for  each  aircraft. ) 

The  transition  probability  matrix,  given  that  a  plane  is  not  grounded, 
is  then  as  shown  in  Table  I.  Note  that  P  (3,  3),  the  probability  of  remain¬ 
ing  in  S3,  is  zero,  because  if  a  plane  was  in  S3  at  the  beginning  of  the  pre¬ 
vious  flight,  it  indicates  that  the  maintenance  was  not  finished,  and  thus  the 
plane  did  not  fake  off.  Hence,  up  to  the  beginning  of  the  present  training 
flight,  there  are  at  least  40  +  24  +  24  =  88  hours  for  maintenance,  and  (from 
Figure  1)  the  probability  of  an  uncompleted  maintenance  action  (tke  or  Ly 
cause  for  S3)  is  zero  at  88  hours  for  both  Tj  and  T^. 
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TABLE  I 

STATE  TRANSITIQN  PROBABILITY 
MATRIX,  [P(i,  j)] 

Previous 

Current  State,  j 

State,  i 

Si 

S2 

S3 

S1 

R  +  RUM 

RUM 

RU 

UM 

UM 

U 

*3 

M 

M 

0 

X  =  1 

-  X 

P(i,  j)  =  transition  probability  from  Sj  to 

Since  the  Kharkov  chain  is  finite  and  irreducible,  steady-state  or 
stationary  probabilities,  P^.,  exist.  These  probabilities  can  be  found 
from  the  following  equations  ; 

Pil  r  P'i<R+  RUM)  +  P'2(UM)  +  p'3m 

Ps2  =  P'^RUM)  +  P'2(lM)  +  P'3M  (4) 

Pa3  =  P;iOT)+P'2(TT). 


These  equations  are  subject  to  the  condition  that  P'.  SO,  i  =  1,  2,  3,  and 
3 

I 


1.0. 


(The  primes  are  used  to  indicat<‘  the  condition  that  the  plane  is  not  grounded. ) 
The  solution  of  this  system  of  equations  is  as  follows: 

/  _  M 


■  1  "  E(ra+TJ)+M 

RM 

•2  "  T^(M+TJ)+M 

/  =  W 

«3  Efll+TD+M 


p' 

P 


(5) 
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if  G  represents  the  probability  of  a  grounded  p’^ne,  we  then  have 


P 

P 

P 

P 


si 

--  c  p  ;, 

s2 

=  G  P' 

*2 

s3 

=  CP', 
s3 

rA 

=  G 

(6) 


The  results  of  applying  Equations  (4),  (3),  and  (6)  are  shown  in 
Table  II. 


TABLE  II 

STEADY-STATE  PROBABILITIES  AT 
SCHEDULED  TAKEOFF  TIME 

State 

Policy 

S1 

S2 

S3 

S4 

P-1 

0.  617 

0.226 

0.057 

0.  100 

P-2 

0.  746 

0.  103 

0.051 

0.  100 

P-3 

0.  646 

0.  237 

0.018 

0.  100 

P-4 

0.  777 

0.  107 

0.016 

0.  100 

P-5 

0.  706 

0.  155 

0.039 

0.  100 

P-6 

0.  801 

0.  066 

0.033 

0.  100 

P-7 

0.  728 

0.  160 

0.012 

0.  100 

P-8 

0.  822 

0.068 

0.0.10 

0.  100 

6.  1.  3  Bombing  Mission  State  Readiness  (Availability) 

If  an  alert  occurs  at  some  time,  z,  during  the  day,  with  a  uniform 
probability  of  occurrence  for  0  S  z  2  24,  it  is  necessary  to  find  the  prob¬ 
ability  that  a  system  will  be  OK  (aj),  Ffa^),  or  G(aj)  at  the  strike  takeoff 
time,  Z,  which  is  h  hours  after  the  aiert  (Z  =  z  t  h).  The  anilyais  will  be 
performed  separately  for  the  two  possible  groups  of  planes:  Group  A,  those 
planes  scheduled  to  fly  training  missions  on  the  day  of  th<*  alert;  and  Group 
B,  those  planes  scheduled  to  fly  the  previous  day.  The  sizes  of  these  two 
groups  are  assumed  to  be  equal. 


6.  1.  3.  1  Group  A 


Three  mutually  exclusive  cases  exist  whirh  relate  alert  time  z  to 
scheduled  takeoff  time  t. 

Case  Aj!  OS  z«C  t  (alert  occurs  before  takeoff) 

Case  A2:  t  s  z  <  t+8  (alert  bccurs  during  flighttime) 

Case  A^:  t+8  &  z<  24  (alert  occurs  after  usual  landing  time). 

Let  f(t)  =  lakeoff>time  density  function,  and  f(z)  =  alert-time  density 
function.  Assuming  uniform  distributions,  we  have 

f(t)  =  1/16,  and  f  (z)  =  1/24. 

Then 

P<V'  ■  raJlfo  dl  *  ■  1/3 

.  fl6ct+8 

P(A2>  s  ikj  0 J  t  dzdt  *  1/3 

P(A3>  "  lw/o/t+8  d*dt  s  1/3‘ 

The  following  conditions  are  assumed: 

(1;  The  probability  that  a  plane  is  in  Group  A  is  0. 5. 

(2)  If  case  Aj  holds  (i<t ),  the  state  at  time  Z  is  dependent  on 
the  state  at  the  landing  time  (L.)  of  the  previous  training  flight 
and  on  the  maintenance  capability,  if  maintenance  is  required. 

.s  a  very  good  approximation,  we  can  use  the  following  equa¬ 
tions  for  this  case: 

al  =  Pa<°K)  =  P.l 

a2  =  Pa(F)  =  P>2+  P.3 

a3  =  PJG)  =  Pg4  . 

It  is  noted  that  planes  in  S2  or  S3  at  t  are  also  in  those  states 
at  z  for  z<  t.  Planes  in  S.  at  t  may  have  been  in  a  failed  state 
at  z  if  the  system  had  a  malfunction  at  the  previous  landing 
time,  and  the  repair  was  made  after  Z  but  before  t.  The 
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probability  that  this  will  occur,  however,  is  very  slight  since 
an  average  ol  4^.  V  maintenance  hours  will  have  accrued  by  Z, 
and  the  approximation,  which  invclves  much  less  than  1/6  of 
the  total  planes,  is  therefore  very  good, 

(3)  If  case  A-,  holds,  it  is  assumed  that  a  plane  cannot  return  to  the 
base  and  be  refueled  and  armed  within  h  hours  (h  will  be  assumed 
to  be  equal  to  1).  Planes  for  which  case  holds,  therefore, 
are  equivalent  to  grounded  planes. 

(4)  If  case  Aj  holds,  the  state  probabilities  depend  on  the  flight 
reliability,  on  the  probability  distribution  of  the  amount  of 
time  available  for  maintenance  after  landing,  and  on  the  main¬ 
tenance  capability. 

The  state  probabilities  at  strike  takeoff  ti—c  'Z)  for  Croup  A 
planes  can  be  determined  from  the  equations  given  below.  Let 

aj  =  probability  of  completed  maintenance  V  v  Z  if  the  aircraft 
flies  on  the  day  of  alert  and  the  alert  occurs  after  landing 
(case  A3),  and 

8  probability  of  completed  maintenance  by  Z  if  plane  is  in 
at  t  and  z>t  (cases  A^  and  A3). 

Then 

P  (OK)  =  Pg,  [p(AjHP(Aj)(R+RV jM)J  +  Pf2[p(A3)VjM] 

+  Ps3  (MM  V2M) 

Pa(F)  =  P(I  [PlAjJJKl-VjM)]  +  P,2  [PtAjHF^tjHl-VjM)]  (7) 

+  p,3  (  fl-P(Aj)]  d-V2M)  +  P(A j) J 

P.(C1  =  P.l  (P,A2>]  +  P.2  [P(A2>]  *  P.«‘ 

To  compute  a , .  it  is  necessary  to  obtain  the  conditional  density  of 
y  =  Z-L,  given  case  A3;  and  the  expected  probability  of  a  completed  main¬ 
tenance  action  is,  for  h  =  1, 
rZ5 

=  J  f(y  |  A3)  T(y)dy, 
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where 


£(y |  Aj)  ia  the  conditional  density  cf  Z-L,  given  case  A^, 

T(y)  ia  the  probability  that  a  maintenance;  action  takes  less  than 
y  hours. 

Since  T(y)  as  plotted  in  Figure  i  is  not  a  standard  distribution,  the  value 
ot  a j  must  be  obtained  by  numerical  integration,  and  i6  computed  to  be 
0. 028  for  T  j  and  0.  099  for  T 2> 

The  calculation  of  a2  is  similar  to  ?  j  except  that,  at  t,  forty  hours 
of  maintenance  have  already  been  accumulated.  Therefore,  the  probability 
of  completed  maintenance  by  Z  for  cases  A2  or  Aj  is  high:  for  Tj, 
a2  =  0.  969;  and  for  T2,  a2  =  0.  999. 

6.  1.3.2  Group  B 

Group  B  consists  of  planes  that  were  scheduled  for  training  flights 
on  the  day  before  the  alert  day.  To  calculate  the  state  probabilities  at 
strike  takeoff  time,  let 


Wj  =  probability  of  a  completed  maintenance  action  by  Z  if  the 
aircraft  flew  on  the  day  before  the  alert  (in  States  Sj  or 
at  usual  takeoff  time  on  day  before  the  alert); 

W,  =  probability  of  a  completed  maintenance  action  by  lime  Z  if 
the  aircraft  did  not  fly  on  the  day  before  the  alert  (in  State 
S3  at  usual  takeoff  time  on  day  before  the  alert). 


Then 


1  =  pb<OK>  =  p.i  [r+  RWjm]  +  P-2  [WjM]  +  Pb3  [w2m] 

2  ■  Pb(F)  =  P€l  [ftd-WjM)]  ♦  P>2  [l-WlM]+  Pb3[uW2m]  (8) 


•3  =  Pb<C)  '  P.4 
ad  W2  are  foun< 

For  Tj»  Wj  =  0.407  and  W2  =  0.999;  and  for  T2,  Wj  =  0.644  and 


W  j  and  W2  are  found  in  a  manner  similar  to  that  used  for  a^  and  *2 . 


w2  =  1.0. 
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The  final  state  probabilities  at  strike  takeoff  time  are  then 


aj  =  P(OK)  =  1/2 


=  P(F) 


1/2 


=  P  (G)  =  1/2 


Pa(OK) 


Pb(OK)| 


Pa(F)  +  Pb(F)J 

Pa(G)  +  Pb(G)]  . 


(9) 


Table  III  summarizes  the  results. 


TABLE  III 

STATE  PROBABILITIES  AT  STRIKE  fAKEOFF  TIME 


Policy 

State 

OK 

F 

G 

P-1 

0.  387 

0.  373 

0.241 

P-2 

0.467 

0.291 

0.241 

P-3 

0.430 

0.  323 

0.247 

P-4 

0.  518 

0.235 

0.247 

P-5 

0.501 

0.256 

0.244 

P-6 

0.  568 

0.  188 

C.  244 

P-7 

0.534 

0.218 

0.  248 

P-8 

0, 603 

0.  149 

0.248 

6.  2  System  and  Strategic  Effectiveness 

With  assumed  values  of  c  j  =  0.  80  and  c^  =  0.25,  Equation  ( 1 )  is 
used  to  obtain  the  Bomb/'Nav  system  effectiveness  for  each  policy.  For 
Policies  1  through  4,  under  the  assumption  of  e  four-hour  bombing  mission, 

R  (4  hours)  -  e-(°-10x4)  =  o.67. 

For  Policies  5  through  8, 

R  (4  hours)  =  e"*0,  05  x  4)  =  0.  82. 

Equation  {2)  can  then  be  used  to  determine  the  number  of  aircraft  N* 
that  must  be  allocated  for  each  target  to  provide  a  strategic  effectiveness  of 
at  least  0.  95  under  Criterion  I.  Numerical  values  for  Criterion  II  can  be 
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derived  from  the  value  of  N’t.  The  results  of  the  above  calculations  are 
shown  in  Table  IV. 

6.  3  ro»t  Estimates^ 


The  coat  o:'  each  policy,  or  ayatem  alternative,  is  aaaumcd  to 
depend  on  four  fact  or  a: 

(1)  Number  of  Aircraft  Allocated  -  It  is  assumed  that  each  plane 
coats  $?,  000,  000,  excluding  the  Bomb/Nav  system,  and  will 
last  an  average  of  ten  years.  The  amortized  monthly  cost 
per  aircraft  is  then  $?5,  000. 

(2)  Reliability  -  The  cost  for  the  Bomb/Nav  system  is  amortized 
over  a  ten-year  period  on  a  single -aircraft  basis  as  follows: 


For  R.  (  K=  0.  10),  cost  =  $2,400,000,  or 
$20,  000  per  month. 

For  R,  (  X.=  0.05),  cost  x  $3,000,000,  or 
$25,  000  per  month. 

(3)  Maintainability  -  The  average  monthly  cost  per  aircraft 
(amortized  and  current)  is  assumed  to  be  $5,  000  for  alter¬ 
native  Tj  and  $15,  000  for  alternative  T~. 

(4)  Maintenance  Efficiency  -  Total  cost  for  alternative  Mj  is 
assumed  to  be  $5,  000  per  month;  and  for  M£»  $10,  000  per 
munlli.  These  cumLs  are  independent  of  the  number  of 


aircraft. 

The  total  policy  cost,  C,  in  thousands  of  dollars  per  month 
for  force  N*  is  then 


C 


N*  x 


20  5  b 

75  +  or  +  or  +  or 

25  15  J  10 


(10) 


6. 4  Final  Solutions 


6.4.1  Summary  Table 


\ 


u 


V 


These  estimates  are  hypothetical  and  are  based  on  simplifying 
assumptions. 
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The  policy  costa,  along  with  the  sy.item  effectiveness  values  and 
required  numbers  of  aircraft,  are  shown  in  Table  IV. 


table  i\ 


FINAL  THEORETICAL  VALUES  FOR  EIGHT  POLICIES 


Policy 

System 

Effectiveness, 

E 

Number  of 
Aircraft 
for  S  =  0.  95, 

N* 

Average 

Monthly 

Cost 

(Thousands 

of 

Dollars),  C 

1 

0.  332 

7. 42 

747 

2 

0.  362 

6.67 

677 

3 

0.  347 

7.03 

779 

4 

0.  379 

6.29 

702 

5 

0.415 

5.59 

592 

/ 

U 

0,445 

5.09 

544 

7 

0.429 

5.35 

620 

8 

0.460 

4.  87 

570 

6.  4.  2  Criterion  1 

For  Criterion  I  it  is  observed  (from  the  cost  column  of  Table  IV) 
that  Policy  6,  requiring  the  assignment  of  5.  09  aircraft  to  each  target,  will 
theoretically  incur  the  lowest  cost  in  providing  a  0.  95  probabV'ty  of  success 
for  destroying  each  target.  However,  since  only  whole  numbers  of  aircraft 
can  be  considered,  it  would  be  necessary  in  practice  to  allocate  six  aircraft 
and  thereby  increase  the  average  monthly  cost  of  this  policy.  In  Table  I' 
it  can  be  observed  that  Policy  8  may,  therefore,  be  the  most  economical, 
since  the  whole  number  for  aircraft  required  (five)  ie  only  slightly  in  excess 
of  the  theoretical  number. 

When  Equation  (10)  is  used  to  compute  the  cost  of  applying  Policy  6 
with  six  aircraft  and  Policy  8  with  five  aircraft,  the  above  suggestion  is 
found  to  be  correct.  (See  Table  V. ) 
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TABLE  V 

PRACTICAL  FORCE  AND  COST  VALUES 
FOR  POLICES  6  AND  8 

Policy 

N*'  j  S*  i  0.95 

Cost 

C' 

6 

6 

640 

8 

5 

585 

Primes  indicate  Practical  Values 

Since  strategic  effectiveness  under  Criterion  I  is  defined  as  the 
probability  that  each  target  in  a  proposed  multi-target  strike  will  be 
attacked  successfully,  the  required  size  of  the  force  is  simply  the  appro¬ 
priate  multiple  of  N*.  Therefore,  Policy  8  is  optimum  not  only  for  a 
one-target  strike  force  but  also  for  strike  forces  designated  for  any  num¬ 
ber  of  targets.  Figure  4  presents  the  average  monthly  costs,  under 
Policies  6  and  8,  of  the  forces  required  for  potential  strikes  on  1  to  20 
targets,  under  the  stipulation  of  Criterion  I. 

several  questions  arise  concerning  Criterion  I.  While  it  is  true 
that  Criterion  I  strictly  requires  at  least  a  0.  95  strategic  effectiveness  for 
each  target,  Policy  6  under  the  practical  case  yields  a  value  of  S  =  0.971, 
and  Policy  8  yields  a  value  of  S  -  0.  954.  Thus,  while  Policy  8  is  less 
costly  than  Policy  6,  the  latter  yields  a  higher  \*alue  of  S,  although  Policy 
8  is  still  better  in  terms  of  "strategic  effectiveness  per  dollar.  " 

One  nay  also  consider  the  effects  of  being  "slightly  below"  the  0.  95 
requirement.  Since  Policy  6  required  a  theoretical  5.09  planes  per  target 
to  yield  a  strategic  effectiveness  of  0.  95,  it  would  seem  that  if  five  planes 
were  allocated,  the  value  of  S  would  be  quite  close  to  0. 95  and,  in  fact, 
does  equal  0.  947.  This  value  would  be  achieved  at  an  average  .non tltly  cost 
of  $535,  000.  In  terms  of  effectiveness  per  hundred  thousand  dollars,  Policy 
6,  with  five  planes,  "ields  a  value  of  1.  77,  while  Policy  8,  with  five  planes, 
yields  a  value  of  1.  63. 

These  questions  emphasize  the  need  for  re-evaluating  the  criterion 


Strike  Force  (Thousands  of  Dollars 


for  optimisation  by  some  iterative  process.  For  this  example,  the  choice 
between  Policies  6  and  8  is  not  clear;  perhapj  other  factors,  such  as 
training  effectiveness  and  policy  feasibility,  must  be  introduced. 

6,  <.  3  Criterion  II 

Criterion  II  stipulates  an  average  strategic  effectiveness  of  0.95 
across  all  targets.  For  a  two-target  strike  under  this  stipulation,  for 
example,  only  11  aircraft  would  be  allocated  under  Policy  6,  instead  of  the 
12  previously  required  under  Criterion  I.  A  value  of  S  =  0.  971  would  be 
provided  for  one  target  by  a  force  of  six  aircraft,  while  S  =  0.947  would  be 
provided  for  the  second  target  by  a  force  of  five  aircraft.  The  average 
effectiveness,  assuming  equal  target  priority,  is  greater  than  0.  95  and 
thus  satisfies  the  requirement. 

Figure  4  also  presents  the  average  monthly  costs  under  Policies  6 
and  8  for  the  forces  required  for  potential  strikes  on  I  to  20  targets  when 
the  requirement  is  2  0.  95  across  all  targets.  It  may  be  observed  that 
for  strikes  involving  one  or  two  targets  Policy  8  is  optimum,  but  for  three 
or  more  targets  Policy  6  is  optimum. 

J  ie  results  of  considering  departures  from  the  required  minimum  of 
Sft  -  0.  95  are  presented  in  Figure  5  which  shows  the  values  of  Sjj  achieved 
by  Po'icies  6  and  8  for  a  potential  strike  involving  1  to  20  targets  wheu  the 
force  sire  ensures  that  fed.  95,  it  may  be  conjectured  from  the  figure 
that  oscillations  will  dampen  out  to  some  va1  ue  slightly  above  0.  95  as  the 
number  of  targets  increases  beyond  20. 

The  strategic  effectiveness  values  shown  in  Figure  4  were  divided 
by  the  average  monthly  cost,  computed  under  both  policies  for  each  of  the 
20  targets,  to  construct  Figure  6.  This  figure  shows  that  there  is  eome 
basis  for  favoring  Policy  6  oyer  Policy  8  for  multiple  targets  in  terms  of 
"strategic  effectiveness  per  dollar;"  but,  as  with  Criterion  I,  the  policy 
choice  may  better  be  made  after  the  inclusion  of  factors. 
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Number  of  Targets 


FIGURE  5 

AVERAGE  STRATEGIC  EFFECTIVENESS  *0.95  WITH 
MINIMUM  COST 


Effectiveness  per  Thousand  Dollars 


1.0 


One  Target 


Policy  Effectivenes»/$  1000 


Number  of  Targets 


n 


FIGURE  6 

EFFECTIVENESS  PER  DOLLAR  FOR  MINIMUM  COST, 
AVERAGE  STRATEGIC  EFFECTIVENESS  >  0. 95 
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ABSTRACT 


A  method  for  allocating  ayatem  reliability  requirementa  among  aubayatem 
(or  lower  level  unite)  ia  preaented.  The  method  considera  aerial  and 
redundant  interconnectione  among  the  aubayatema.  The  relationahip 
between  ayatem  reliability  requirementa  and  ayatem  effectivenesa  require 
menta  ia  conaidered. 
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1.0 


INTRODUCTION 


Milit&xy  agencies  responsible  for  providing  weapon  systems  for 
operational  use  must  translate  the  overall  system  requirement  into  quanti¬ 
tative  reliability  requirements  at  many  system  sub-levels.  Realistic  and 
consistent  reliability  requirements  for  units,  equipments,  or  subsystems 
must  be  assigned  in  order  to  achieve  and  demonstrate  specified  operational 
weapon-system  reliability.  This  assignment  is  commonly  called 
"reliability  allocation.  " 

The  allocation  process  is  an  important  element  in  an  overall  optimi¬ 
zation  program  since  it  essentially  provides  a  set  of  optimum  reliability 
goals  based  on  a  selected  decision  criterion.  At  a  minimum,  it  provides 
a  set  of  requirements  on  reliability  characteristics  which  represent  achiev¬ 
able  goals  in  terms  of  the  state-of-the-art.  One  car,  however,  also  include 
in  the  allocation  model  such  factors  as  maintenance,  cost  of  reliability  im¬ 
provement,  and  cost,  weight  and  space  factors  associated  with  redundancy 
in  order  to  obtain  a  set  of  goals  or  requirements  that  are  not  only  repre¬ 
sentative  of  current  capabilities  but  involve  variables  which  ">.ct"  on  these 
capabilities. 

T*'e  allocation  method  presented  here  is  based  primarily  on  state- 
of-the-art  factors,  system  configuration  and  mission  requirements.  Step- 
by-step  procedures  for  implementing  the  method  are  presented. 

2.0  FACTORS  INCLUDED  IN  THE  ALLOCATION  METHOD 

This  section  describes  those  factors  and  influences  which  are 
considered  to  be  of  sufficient  importance  for  explicit  inclusion  in  the  method. 
These  factors,  therefore,  will  have  to  be  translated  to  quantitative  terms  or 
be  capable  of  mathematical  representation  and  analysis. 

2.  1  System  and  Failure  Definitions 

The  system  under  consideration  must  be  clearly  defined  in  terms  of 
its  functions  and  boundaries .  The  conditions  that  constitute  failure  or 
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unsatisfactory  performance  can  be  determined  from  a  study  of  the 
operational  demands  and  the  functional  requirements  of  the  system.  Those 
conditions  can  then  be  translated  into  measurable  unit  characteristics.  The 
boundaries  surrounding  the  system  and  each  unit  n.uei  be  clearly  defined  to 
insure  that  important  items  arc  neither  neglected  nor  considered  more  than 
once. 

2.  2  System  Reliability  Requirement 

The  primary  element  in  a  reliability  allocation  method  is  the  system 
reliability  requirement.  It  is  usually  determined  on  the  basis  of  ultimate 
user  requirements  and  feasibility,  but  it  may  derive  from  an  allocation  per- 
formed  at  a  higher  echelon.  The  requirement  may  be  stated  in  any  appro¬ 
priate  measure  such  as  mean  life,  system  failure  rate,  or  preferably,  a 
reliability  requirement  for  a  specific  period  of  time. 

The  success-probability  requirement  on  a  weapon  system  may  be 
based  on  the  desires  of  field  personnel  who,  naturally,  link  in  terms  of 
the  probability  that  the  system  can  successfully  complete  some  specific 
mission,  probably  under  wartime  conditions.  The  supplier  of  the  system 
cancot,  however,  design  or  test  the  system  under  these  same  conditions. 

The  tran*.  at  ion,  therefore,  must  be  made  in  the  writing  or  interpretation  of 
a  specific?.!:' on,  which  requires  certain  measurable  system  and  equipment 
parameters  to  be  within  specified  limits  under  specified  environmental  con¬ 
ditions,  with  the  implication  that  hardware  meeting  these  requirements  will 
also  fulfill  the  military  mission. 

We  shall  ordinarily  interpret  a  success -orobability  requirement  in 
the  usual  reliability  sense.  That  is,  a  requirement  of  R+(T)  shall  be  inter¬ 
preted  to  be  the  probability  that  the  system  will  satisfactorily  meet  all 
design  specifications  for  T  hours  of  operation  under  stated  conditions.  By 


^  As  part  of  the  allocation  process,  one  should  first  investigate  the 
feasibility  of  the  overall  requirement.  This  may  be  done  by  considering  - 
past  reliability  performance  of  systems  of  simitar  complexity  operating  in 
a  similar  environment.  Feasibility  determination  is  not  discussed  here. 


assuming  values  for  operational  readiness  (availability)  and  design 
capability,  one  can  obtain  the  equivalent  reliability  requirement  from  a 
requirement  stated  in  terms  of  a  system  effectiveness  parameter. 

2.  3  Unit  State-of-thc-Art 

State-of-the-art  measures  are  required  in  order  to  determine  the 
relative  reliabilities  of  the  allocation  units  within  the  system.  These  are 
the  basic  data  inputs  in  a  typical  reliability  allocation  procedure  and  are 
usually  stated  in  terms  relatable  to  the  measure  used  for  the  system  reli¬ 
ability  requirement.  Relative  average  failure  rates  are  the  state-of-the- 
art  measures  adopted  in  this  study.  They  will  give  exact  answers  for  units 
with  constant  failure  rates;  furthermore,  they  represent  a  reasonable 
approach  for  other  typical  failure  densities. 

2. 4  Relationship  Between  Unit  and  System  Failure 

The  relationships  between  unit  failure  and  syc'  *m  failure  must  be 
determined  before  the  allocation  is  rrade.  Four  types  of  basic  relationships, 
for  which  allocation  methods  are  presented,  are  as  follows:  ■ 

( 1 )  Serial  system:  no  functional  duplicates  exist  and  each 
unit  must  operate  successfully  for  system  success. 

11)  Modified  serial  system;  no  functional  duplicates  exist 
but  units  can  fail  without  necessarily  causing  system 
failure. 

(3)  Redundant  system:  components  of  the  system  ar* 
diplicated  for  increased  reliability  but  each  redundant 
path  or  mode  of  operation  is  equally  effective  in  per¬ 
forming  its  function. 

(4)  Multimodal  system:  redundant  paths  or  modes  of 
operation  are  not  equally  effective  in  performing  their 
function.  ^ 


^  Multimodal  systems  are  not  considered  here.  An  approach  for 
reliability  allocation  of  multimodal  systems  is  presented  in  the  report, 
The  Allocation  of  System  Reliability.  H.  Balaban  and  H.  Jeffers,  ARINC 
Research  Corp. ,  Publication  No.  274,  Volume  I,  November  1961. 
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2.4.  1  Unit  Essentiality 


The  concept  of  essentiality,  used  to  describe  the  effects  of  unit 
failure  on  mission  success,  is  considered  only  if  a  failed  unit  has  no 
functional  duplicate.  It  is  defined  as  follows. 

The  essentiality  of  a  unit  is  the  probability  that  the 
system  will  fail  to  accomplish  its  mission  if  the  unit 
fails  while  all  other  units  perform  satisfactorily. 

An  example  of  a  unit  which  might  have  an  essentiality  less  than  one 
is  a  radar  beacon  transmitter  on  a  satellite  used  for  tracking  purposes.  If 
the  beacon  fails  after  the  orbit  has  been  firmly  established,  the  orbital 
position  may  possibly  be  obtained  through  mathematical  analysis. 

Unit  essentiality  must  be  considered  in  the  allocation  of  reliability 
of  modified  serial  systems;  it  may  also  be  involved  in  redundant  and  multi¬ 
modal  systems.  At  the  design  stage  of  system  development,  the  likelihoed 
is  that  the  essentiality  of  various  units  within  the  system  will  have  to  be 
assigned  intuitively  on  the  basis  of  experience  gained  with  similar  systems. 
If  appropriate  system  failure  data  is  available,  essentiality  can  be  estima¬ 
ted  by  the  r&'  ,o, 

_  dumber  of  Mission  Failures  due  only  to  ith  Unit  Failure 
j  ”  Number  of  j"h  Unit  Failures 

2.  5  Unit  Duty  Cycles 

Duty  cycles  must  be  include  i  in  ar.  allocation  method  to  .  effect  any 
variance  in  unit  operational  time  requirements  with  respect  to  systems 
operation-time.  Units  which  have  a  limited  operational  period  because  of 
a  low  duty  cycle  (e.  g. ,  the  hydraulic  system  of  an  airplane)  should  have  a 
relatively  high  allocation  over  the  system  operating  period. 

3.0  MATHEMATICAL  MODEL  FOR  ALLOCATION  METHOD 
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3.  1  Requirements  of  the  Allocation  Model  ^ 

The  following  requirement*  exi*t  in  developing  a  reliability 
allocation  model: 

(1)  Allocated  unit  reliability  increase*  a*  unit  state-  of- 
the-art  decreases. 

(2)  Allocates  jnit  reliability  increases  as  essentiality 
increases. 

(3)  Allocated  uni*-  reliability  increase  as  duty  cycle  or 
required  time  of  operation  decreases. 

(4)  Units  in  a  system  with  equal  essentiality,  duty  cycle 
and  state-of-the-art  should  have  the  same  allocated 
reliability  whether  in  series  or  in  a  redundant  con¬ 
figuration  within  the  same  system. 

3. 2  Assumptions 

The  following  two  basic  assumptions  are  made  in  developing  the 
allocation  model: 

(1)  Allocation  units  can  be  so  chosen  that  failure  probabilities 
are  independent. 

(2)  Unit  state  can  be  described  in  discrete  terms  of  success 
and  failure. 

These  two  assumptions  greatly  simplify  the  mathematics  of  alloca¬ 
tion  and  are  believed  to  be  reasonable  for  the  purposes  of  a  design-stage 
reliability  allocation  method.  With  regard  to  the  first  assumption,  if 
components  within  the  system  are  known  to  be  dependent,  they  may  pos¬ 
sibly  be  grouped  into  one  allocation  unit,  making  the  failure  probability  of 
this  unit  independent  of  the  state  of  other  units.  The  state-of-the-art  of 
this  unit  can  then  be  adjusted  for  the  dependence  that  exists. 

The  second  assumption  is  reasonable  in  the  sense  that  reliability, 
by  definition,  requires  that  satisfactory  performance  be  uniquely  defined. 


2/ 


Cost  is  not  treated  as  a  factor  here. 


4 

1 
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In  prixuice,  this  is  often  a  most  difficult  problem,  and  aucceaa /failure 
definitions  are  neceaaarily  somewhat  arbitrary.  If  allocation  is  primarily 
regarded  as  a  procedure  for  defining  parameters  of  reliability  acceptance 
t.jts.  such  teste  usually  require  that  this  second  assumption  be  satisfied  in 
order  to  determine  if  a  unit  has  passed.  In  this  case,  the  same  success/ 
failure  defin'tiona  for  such  tests  should  hold  for  allocation.  The  allocation 
model  does  not  require  explicit  success/failure  definitions,  but  since  the 
input  data  is  based  on  success /failure  appraisals  of  field  personnel,  it  is 
implicitly  assumed  that  similar  appraisals  can  be  made  for  the  units  under 
consideration. 

3.  3  Data  Input 

The  data  inputs  to  the  model  which  reflect  the  unit  st'.te-of-the-art 
are  called  the  unit  failure  irdlces.  These  indices  are  obtained  from  the 
relative  failure  rates  of  the  elements  in  a  unit  which  are  based  on  such 
factors  as  type  of  active  element,  type  of  function,  part  types,  an 4 
environment. 

If  the  j*h  unit  has  a  failure  index  of  K.,  the  total  system  failure 

4/  J 

index  for  at  serial  system—',  K,  is  defined  by 


n 

K  =  y  K.  . 

j  *  1  j 

The  failure  index  ratio  or  relative  weight  of  each  unit  is 


(1) 


w. 


(2) 


The  basis  for  the  allocation  is  that  each  unit  of  w  has  an  equal  effect 
on  system  reliability  in  the  same  sense  that  each  unit  of  failure  rate  has  rn 
equal  effect  on  reliability.  Thus,  the  failure  contribution  of  the  jth  unit  is 
proportional  to  Wj  and  as  shown  in  Section  3.  4,  the  effect  can  be  quantified 
by  using  the  wj  as  exponent  weighting  factors. 


1/ 


See  Section  3.  6  for  a  discussion  of  redundant  systems. 


3.  4  Allocation  Method  for  Serial  System* 


In  this  section  we  shall  derive  the  ■ll'v-ation  equation  for  a  serial 
system  consisting  cf  n  independent  units.  From  basic  reliability  theory, 
for  a  system  of  this  type,  the  system  reliabiiii.}  function  is 


where 


K{T)  =  exp  f-  £  ftjZ(T  )d  ] 

1  j.l  Jo  i  i 


R(T)  is  the  system  reliability  over  T  system  hours 

,th 


(3) 


is  the  required  operating  time  of  the  j  unit  over  T 
system  hours 

.th 


Z(  Tj)  is  the  hazard  rate  function  for  the  j  unit. 

For  the  exponential  distribution,  Z(t^)  is  constant  over  time  and  is 
equal  to  what  is  commonly  called  the  failure  rate,  K  y  For  other  failure 
densities,  if  the  hazard  rate  function  is  approximately  constant  over  tj 
hours,  e.g. ,  the  effects  of  wearout  in  time  period  (0,  tj)  are  negligible,  the 
Z(t^)  in  equation  (3)  can  be  replaced  by  average  hazard  rates  estimated 
from  appropriate  failure  data.  A  common  formula  for  obtaining  such  an 
estimate  is 

Number  of  failures  in  (0,t  ) 

- . - 1 - 


J  Total  accumulated  operating  time 
The  substitution  of  for  Z(  r  in  equation  (3)  yields 

R(T)  =  exp 


=  exp 


kf.vJ 

M 


(4) 


where 


X#  is  the  estimated  system  hazard  rate  for  (0<T<T) 
\  j  is  the  estimated  j**1  unit  hazard  rate  for  (0<  t  jdj 


). 
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If  a  system  rel  iability  requirement  of  R*(T)  exists,  one  can  find 

n 

an  equivalent  X*  by  equation  (4).  Since  X  T  -  2  X.t. 


ir*  I 


J  J 


allocated  aver¬ 


age  uni,  failure  rates  of  ^  must  be  determined  so  that 


*  K  ,t.  =  X*  T  . 


j=l 


TJ 


(5) 


A  reasonable  approach  is  to  equate  each  >  ^  in  equation  (5)  to 
Wj  X*^T  si  'e  the  reliability  contribution  of  the  jth  unit  is  proportional  to 
Wj,  Hence,  allocated  average  unit  failure  rates  can  be  determined  from  the 
equatior . 


or 


X  »  Wj  X*,T 
R*(T)  =  e‘  X  *sT 


=  e-wi  X*.T  e-w2X*gT  ..  e,wn^iT 
The  allocated  reliability  of  the  jth  unit  for  r  operating  hours  is 


^ (t j )  -  e‘ 


wj  =  [w(T)]wi 


Allocated  failure  rate  requirements  are  obtained  as  follows: 


w.\*(T 


lOg  A(tj)/t y 


(6) 


(7) 


(8) 


(9) 


For  R(t,)  ^0.9, 


w . 

b  *  -  — i  log  R*(T). 

J  j 


(1C| 


Mean  life  requirements  can  be  obtained  as  the  reciprocal  of  the  allocated 
failure  rates. 

An  average  failure  rate  for  units  in  which  the  hazard  rate  function  is 
not  constant  can  be  allocated  by  the  equation 


A 


(H) 
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3.  5  Allocation  Method  for  Modified  Serial  Systems 

For  modified  serial  systems,  one  or  more  units  have  essentialities 
less  turn  or.c  and  therefore  these  units  may  fail  without  necessarily  caueinp 
system  failure.  Th^  probability  that  the  system  will  not  fail  due  to  failure 
of  the  j1*1  unit  is 

i  -  Ej  [l-R{tj)]  (12) 

Under  the  assumption  of  independent  unit  failures  and  serial  operation,  a 
good  approximate  formula  lor  system  reliability  is 

R(T)  «  'IT  (l  -  Ej  [l  -  Rfy)  j  (13) 

This  formula  is  approximate  in  the  sense  that  it  implies  independence  of 
unit  essentialities,  e.  g. ,  the  probability  of  system  failure  given  failure  of 
units  A  and  B  is  E^  E^.  Since  E  will  most  likely  be  one  fer  the  majority  of 
units,  the  above  equation  is  reasonable. 

If  R*(T)  is  the  system  reliability  requirement,  the  allocated  contri¬ 
bution  of  the  jth  unit  to  system  reliability  as  given  by  equation  (8)  is 

(  R*(T)  ]  Wj 

A 

Hence,  by  equation  (12),  R(n'  must  be  chosen  so  that 
1  -  Ej  [l  -  ft(t  )]  «  [R*(T)]Wj 

or  w 

ft(t.)=  l-l-**JTLJ  (14, 

J 

This  is  the  formula  derived  in  the  AGREE  report-^.  It  is  important  to 

wi 

note  that  Ej  must  be  greater  than  1  -  R*(T )  *  in  order  to  avoid  negative 
reliability  allocations.  In  most  practical  situations,  especially  where 


^  Advisory  Group  on  Reliability  of  Electronic  Equipment,  Office  of  the 
Assistant  Secretary  of  Defense,  Reliability  of  Military  Electronic  Equipment, 
June  4,  1957,  pp.  52-57, 
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weight  and  space  are  at  a  premium,  units  with  low  essentiality  and  high 
failure  indices  are  not  common.  If  a  unit  does  exist  for  which 
w< 

E  >  1  -  R*(T)  J  .  it  is  recommended  that  this  unit  be  eliminated  from  the 

j 

allocation  and  the  failure  index  ratios,  w,  of  the  remaining  units  be  re¬ 
computed. 

Failure  rate  and  mean  life  allocation  equations  can  be  derived  in  the 
same  manner  as  for  serial  systems.  By  computing  ft(tj)  from  equation 
(14),  equations  (9)  and  (10)  remain  unchanged.  The  approximate  formulas 
for  failure  rate  and  mean  life  allocations  become 


1  Wj  log  R*(T) 

A  w.  log  R*(T) 

=  “  ;  r  t - 

j  Ejtj 

3.  6  Allocation  Method  for  Redundant  Systems 


(15) 


A  redundant  system  is  defined  here  as  one  in  which  some  (or 
possibly  all)  of  the  elements  have  functional  duplicates  for  purposes  of  in¬ 
creasing  B/stem  reliability.  Fach  redundant  path  or  mode  of  operation  is 
assumed  to  be  equally  effective  in  performing  its  function,  i.  e. ,  the  design 
capabilities  of  all  modes  of  operation  are  equal. 


Two  specific  redundancy  types  are  considered: 

(a)  Active-parallel  or  continuous  redundancy  where  all 
redundant  units  are  continuously  energised  at  any  one  time. 

(b)  Standby  or  sequential  redundancy  where  only  one  of 
the  redundant  units  is  energised  at  any  one  time. 

If  switching  is  involved  (as  it  always  is  for  standby  -dundancy),  the 
probability  of  premature  switching  (switching  when  not  required)  shall  be 
assumed  to  be  relatively  small  as  compared  to  the  probability  of  failure  to 
switch  when  required.  The  switching  mechanism,  if  it  is  subject  to  failure, 
can  therefore  be  considered  as  a  series  unit. 
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The  following  model  applies  only  to  redundant  systems  which  contain 
a  single  redundant  configuration,  i.  e. ,  only  one  unit  or  one  group  of  units 
is  duplicated.  The  degree  of  redundancy  is  fixed  at  two,  i.  e. ,  there  are 
only  two  paths  of  operation  for  the  particular  func*mn  which  is  duplicated. 
The  latter  restriction  was  made  primarily  herause  of  the  belief  that,  at  the 
design  stago,  redundancy  is  not  and  should  not  be  used  extensively  since  the 
technique  can  be  employed  much  more  effectively  after  allocations  are  made 
and  predictions  or  laboratory  tests  performed  to  determine  possible  trouble 
areas.  The  extension  of  the  model  to  degrees  greater  than  two  is  easily 
made  and  briefly  discussed  in  Section  3.  6.  1. 

The  restriction  on  the  number  of  redundant  configurations  is  wlso 
justified  by  the  above  argument  and,  in  addition,  the  complexity  of  the 
allocation  model  is  greatly  increased  for  more  than  one  configuration.  If 
the  system  has  two  or  more  redundant  configurations,  an  approximation 
that  will  yield  conservative  allocations  can  be  made. 

Assume  two  units  are  duplicated  in  a  redundant  design.  The  reli¬ 
ability  block  diagram  of  the  system  will  therefore  be  as  shown  in  Figure  1. 


FIGURE  ' 

BLOCK  DIAGRAM  OF  SYSTEM  WITH  REDUNDANCY 

"A"  represents  all  series  units.  By  eliminating  the  cross -connects 
between  the  B  and  C  configurations,  the  block  diagram  reduces  to  that 
shown  in  Figure  2. 
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FIGURE  2 

BLOCK  DIAGRAM  EQUIVALENT  TO  FIGURE  1 

This  is  a  single  redundant  configuration  for  which  the  method  applies.  The 
method  also  permits  allocation  to  the  individua1  B  and  C  units  as  well  as  to 
the  redundant  configuration  and  to  the  redundant  units  composed  of  B  and  C. 
Since  the  reliability  of  the  second  system  is  generally  lower  than  that  of  tne 
first,  the  reliabilities  allocated  will  be  somewhat  higher  than  actually  re¬ 
quired. 

3.  6.  1  Identical  Redundant  Paths 

The  reliability  block  diagram  of  a  system  with  a  single  redundant 
configuration  consisting  of  identical  redundant  paths  is  shown  in  Figure  3. 


FIGURE  3 


REDUNDANT  CONFIGURATION  -  Ur 
(Identical  Redundant  Units) 

Unit  A  represents  the  combination  of  sill  series  units.  Unit  U  j  is  a 
redundant  unit  (possibly  including  more  than  one  allocation  unit)  which  is 
duplicated  to  form  the  redundant  configuration.  shall  be  used  to  designate 
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the  total  failure  index  of  the  series  unit,  and  K  ,  the  total  failure  index  of 

1  i 

each  redundant  unit. 

The  method  used  to  allocate  the  system  reliability  requirement  to 
Unit  A,  to  the  redundant  configuration,  and  to  eacn  redundant  unit  is  to  de¬ 
termine  an  equivalent  complexity  for  the  redundant  configuration  Kv  which 
will  justify  use  of  the  basic  allocation  formulas  for  serial  or  modified  serial 
systems.  The  derivation  for  determining  is  given  below. 

Equation  (8)  gives  the  basic  allocation  equation  for  serial  systems 
*  R* 

(operating-times  can  be  neglected  for  the  present). 

Since  redundant  configuration  Uf  is  in  series  with  Unit  A,  allocations  based 
on  equation  (8)  can  be  performed  if  values  can  be  found  for  w^,  the  failure 
index  ratio  of  Uft ,  and  for  wf ,  the  failure  index  ratio  of  Uf .  By  definition, 


w, 


•  or  w. 


log  ft. 
:IogTl* 


K 


w 


w 


Ka+Kr 


(16) 


K 


*a  +  Kr 

where  is  as  yet  undetermined. 

If  some  sub-combination  of  units  in  Umt  A  (the  series  unit)  had  a 
total  failure  index  of  Kf  j  (the  failure  index  of  each  redundant  element),  the 


failure  indox  ratio  of  this  sub-combination  is 


K 


rl 


rl 

Ka  +  Kr 


(17) 


Since  units  with  the  same  failure  index  ratio  are  required  to  have  the  same 
allocated  reliability  (assuming  equal  essentiality  and  duty  cycle)  whether  in 
series,  parallel,  or  both,  wy j  above  is  also  the  failure  indax  ratio  of  UrJ 
and  Ur2 .  By  equations  (8),  (16),  and  (17) 


63 


Hence 


w 

i* 


log  ft  K 

a  r  _ r_ 

*** 7l  “  Krl 


K 


r 


K,1  '°8  K 

l0*  “rl 


Substituting  for  Kf  in  equation  (16)  yields 

>'rl  *°«  K 

WT  '  Ka  log  ftrl  +  Krl  log  ft  r 
Since  we  also  have 

log  ftr 


Wr  “  log  R* 


equation  (18)  can  be  rewritten  and  simplified  *o 
KH  log  R*  -  Ka  log  ftrl 


log  Rr  = 


TT 


rl 


or 


where 


log  ftf  =  log  R*  -  or  log  ftrl 


a  = 


fs 

K 


rl 


(18) 


(19) 


(20) 


In  general,  ft  is  some  function  of  &rl  ,  the  allocated  reliability  of  the 
redundant  units,  e.g. ,  for  active-par  allel  redundancy 

K  -  Ai  -  <Ki>L  ■ . 


Hence,  by  the  inverse  relationship, 


(Note:  Since  relationships  of  this  type  exist  for  any  number  of  redundant 
units,  the  method  applies  to  all  degrees  of  redundancy. ) 
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(19) 


on 


Writing  &  .  an  some  function,  ft.  ,  =  f(R  ).  we  have  from  equati 
r  i  n  r 

log  Rr  =  log  R*  -  or  log  [f(ftr)'|  .  (21) 

For  a  given  or  and  R*,  equation  (21)  can  oe  used  to  determine  ftf  for  a 
,  specific  type  of  redundancy.  The  remainder  of  the  system  (Uiit  A)  is  then 
*  reliability  of  R+/kr .  It  is  possible,  however,  to  use  equation 
(21)  to  determine  Kr  directly  as  shown  below. 

From  equation  (16; 


K 


T^T)K  a 


(22) 


By  equation  (8) 


log  Rr 
log  R* 


Hence,  for  a  given  or  and  R*,  equation  (21)  can  be  used  to  obtain  wf(  or,  R*). 
This  enables  us  to  obtain  the  ratio 


w  ( or ,  R*) 

7.1  o.  R*)  =  - - — , - - 

l  -  w  (  or  ,  R*) 


(23) 


Then  from  equation  (22) 

Kr  =  Z(  or  ,  R*)Ka 


(24) 


^Nomographs  giving  values  of  Z(  or,  R */  for  wide  ranges  of  or  and  R*  for  both 
active -parallel  and  standby  redundancy  are  presented  in  Figures  8  to  11  of 
Section  4. 0),  Once  Kr  is  determined,  the  total  failure  index  of  the  system 
can  be  found  by 


K  =  Kj  +  K2  + 


+  K  +  K 
m  r 


where  Kj  to  are  the  failure  indices  of  the  units  in  series  (represented 
by  in  the  above  derivation).  Failure  index  ratios  are  then  found  by 

Wj  ^  Kj/K 


65 


for  each  series  unit,  the  redundant  configuration  and  for  each  redundant 
unit  as  well.  The  allocation  equations  for  serial  or  modified  serial  sys¬ 
tems  then  apply. 

3.  6.  i.  Duplicate  Systems 

For  designs  where  the  complete  system -is  duplicated,  allocation  is 
relatively  simple.  For  active -parallel  operation,  the  reliability  require¬ 
ment  for  each  system  is 

Rtl(T).  1  -  [1  -  R»(T)]1/2 

Kl  <T>  can  then  be  considered  to  define  Rrj*(T),  the  reliability  require¬ 
ment  of  each  system,  which  then  can  be  sub-allocated  among  the  units  of 
the  system  by  methods  previously  described.  For  standby  redundancy 
(under  the  assumption  of  constant  failure  rates), 

R*(T)  =  &rl  (T)  Cl  -  log  kr,(T>] 

F'r  a  given  R*(T),  &rj  (T)  can  be  graphically  determined  and  sub-alloca¬ 
tions  withir.  the  system  for  Rrj*(T)  =  (T)  can  be  performed. 

3.  6.  3  Dissimilar  Redundant  Paths 

AsGume  the  block  diagram  of  the  system  is  as  shown  in  Figure  4. 


FIGURE  4 

REDUNDANT  CONFIGURATION  -  Ur 
(Dissimilar  P.edundant  Units) 

U&  represents  all  units  which  are  in  series.  The  redundant  configuration, 
Ur ,  is  composed  of  two  dissimilar  redundant  units,  Uyl  and  Up2  which 
are  equally  effective  in  performing  the  required  function.  will  be  used 
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to  dc-ignate  the  failure  index  of  Ua ,  and  Krj  and  the  failure  indices  of 
U  |  and  II  ^  ,  respectively.  The  method  used  to  allocate  reliability  is  to 
find  a  failure  index  for  eacli  redundant  unit,  K^, ,  so  that  for  a  given  time 
oeriod 


R  (K'  .  K')  =  R  (K  .  ,  K  ,  ) 
r  '  r  r '  r  1  r  1  r2' 


where  Rf  (K. ,  Kj )  represents  system  reliability  for  a  given  time  period, 
given  redundant  unit  failure  indices  of  and  Kj . 

Given  an  equivalent  failure  index  of  K* ,  equation  (24)  can  be  used  to 
obtain  Kr  ,  the  failure  index  of  the  redundant  configuration,  and  the  basic 
allocation  equations  then  obtain.  The  following  discussion  is  limited  to 
redundant  units  which  have  approximately  constant  failure  rates. 


3.  6.  3.  1  Active -Parallel  Redundancy 

Let  X  represent  the  average  failure  rate  of  the  normalizing  function. 
The  KjT  represents  the  absolute  failure  rate  of  the  j1*1  unit  since  Kj  is  ob¬ 
tained  as  the  sum  of  component  failure  rates  in  the  unit  relative  to  the 
normalizing  function.  The  reliability  function  for  two  units  in  an  active- 
parallel  redundant  configuration  is 


R(t, 


e’S-I*  ♦  e"Xr2‘  -e‘(Xrl  +  Xr2}t 


where  X  j  rjid  Xy2  are  the  failure  rates  of  the  redundant  units.  The 
problem  then  is  to  find  a  value  of  so  that 


-KrlXt  -Kr2Xt  -(K.+K,)Xt  -Kit  -2KXt 

e  +  e  -e  =  2e  -  e 

-x  2 

If  we  use  the  approximation  e  =l-xlx/2,  the  above  equation 
reduces  to 

Kr/=(Krl  *  Kr2>!/?  <25> 

This  approximate  formula  for  K '  is  usually  satisfactory.  Equation  (24)  can 
then  be  used  to  obtain  Kf  and  the  allocations  for  the  units  >a  series,  for  the 
redundant  units,  and  for  the  redundant  configurations  are  obtained  by  the 
allocation  equations  given  for  serial  or  modified  serial  systems. 


( 
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3. 6. 3. 2  Standby  Redundancy 


From  the  general  reliability  function  of  a  standby  redundant 
configuration,  must  be  determined  so  that 


Krl 


•Kr2Xt 


Kr2 

*7T^' 


-Krl« 


-K  Xt 

e  r  (1  +  K'  T  t) 


The  same  approximation  for  e~x  as  was  used  for  active -parallel 
redundancy  can  also  be  employed  to  obtain  an  estimate  for  .  This  ex¬ 
pression,  however,  will  yield,  for  the  right  hand  side,  a  term  that  involves 

**3  3  —  -6  “33 

X  t  .  Since  ^  will  be  quite  small  (say  on  the  order  of  20  :  10  ),  X  t 

is  negligible  for  the  range  of  t  usually  involved.  On  dropping  the  term 
involving  the  approximate  formula  for  K'  is  identical  to  equation 

(25).  Tests  of  fifteen  pairs  of  and  showed  an  average  error  of  2% 
for  Ky.  The  maximum  error  was  aboit  10%  which  occurred  for  the  ex¬ 
tremely  unlikely  ratio  of  Krj/Kr2  =  100. 

Equation  (24)  can  be  used  to  obraiu  Kr  and  then  basic  allocation 
equations  apply. 

VJ 

4.  G  PROCEDURAL  STEPS  FOR  ALLOCATION 

4.  i  Introduction 

This  section  illustrates  the  step-by-step  procedures  for  determining 
allocated  unit  reliabilities  for:  serial  and  modified  serial  systems,  and 
redunoant  systems.  The  required  data  inputs  are  the  relative  functional 
failure  rates  and  the  modification  factors  reflecting  the  influences  of  special 
or  nontypical  conditions. 

Two  assumptions  are  required  for  proper  utilisation  of  the  allocation 
methods.  They  are: 

(1)  That  allocation  levels  can  be  so  chosen  that  failure 
probabilities  are  independent,  i.  e. ,  dependent  com¬ 
ponents  can  be  grouped  into  one  unit,  making  failure 
probability  of  this  unit  independent  of  the  state  of  the 
other  units. 
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(2)  That  the  unit  state  can  be  described  in  discrete  terms 
of  success  and  failure  through  analysis  of  the  system 
reliability  requirements  and  the  functional  relationship 
between  unit  and  system  operat5o*v 

The  procedural  steps  have  been  designed  to  accommodate  each  of  the 
specific  system  types.  Attention  ie  called  to  the  fact,  however,  that  five 
steps  are  applicable  to  all  systems.  These  are  described  in  Section  4.2, 
and  are  preliminary  to  any  steps  that  are  peculiar  to  the  specific  system 
types.  Steps  applying  to  serial  and  modified  serial  systems  will  be  found 
in  Section  4.  3.  Steps  for  redundant  systems  are  described  in  Section  4.4. 

4.  2  Initial  Steps  (Applicable  to  all  Systems  Types) 

The  following  s*eps  apply  to  all  of  the  system  types  considered 
herein  and  must  be  accomplished  first.  The  steps  peculiar  to  each  system 
type  are  to  be  performed  in  the  order  listed.  (See  Sections  4.  3  and  4.4. ) 
The  sample  allocation  work  sheet,  Figure  5,  can  be  used  for  all  system 
types. 

(a)  Define  the  units  for  which  the  system  reliability  requirement  is 
to  be  allocated  by  constructing  a  reliability  block  diagram 
showing  the  unite  (blocks)  of  the  system  in  logical  sequence. 

(b)  Determine  the  system  type  (serial  or  modified  serial,  redundant 
or  bimodal)  by  referring  to  the  definitions  given  in  Section  2. 4. 
The  term  redundant  configuration  shall  apply  to  the  group  of 
redundant  units. 

(c)  Obtain  unit  failure  indices  Kj  .  These  Kj's  she  ild  be  listed  on 
an  allocation  worksheet  similar  to  that  of  Figure  5. 

(d)  From  the  definition  of  system  success  and  the  operational  de¬ 
mands  imposed  on  each  unit,  estimate  the  essentiality,  Ej,  of 
each  series  unit  and  the  redundant  configuration  if  applicable. 
(For  unmodified  serial  systems,  E  is  equal  to  one  for  all  units. ) 
List  the  unit  essentialities  in  the  appropriate  column  of  the 
worksheet  . 
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SAMPLE  ALLOCATION  WORKSHEET 


(e)  If  the  system  requirement  is  in  terms  of  a  probability  of 
successful  operation  for  T  hours,  estimate  the  average 
operating  time,  tj ,  of  each  unit  and  the  redundant  configuration 
during  T  system  hours  of  operation.  1 1  the  requirement  is  in 
terms  of  mean  life  or  failure  rate,  a  value  of  T  should  be  chosen 
to  represent  a  significant  period  of  system  operation  such  as 
average  mission-time  or  average  maintenance-period.  Pro¬ 
vision  for  listing  the  r's  is  also  made  on  the  worksheet. 

After  the  completion  of  the  above  steps,  refer  to  Sections  4.  3  or 
4.4  for  the  specific  system  type  under  consideration. 

4.  3  Final  Steps  (Serial  or  Modified  Serial  Systems) 

Assuming  that  the  preliminary  steps  described  in  Section  4. 2  have 
been  completed,  then  the  following  steps  for  serial  or  modified  serial  sys¬ 
tems  should  be  performed  in  the  order  listed. 

The  identification  notation  shown  in  Figure  6  will  be  used. 


( 


FIGURE  6 

NOTATION  CONVENTION 

where  U,  to  U  are  series  or  modified  series  units, 
i  n 

£>  1.  Determine  the  system  reliability  requirement  by  first 

estimating  system  design  capability.  If  the  design  capability 
is  less  than  one  (1.0),  the  original  system  requirement  shal 
be  considered  to  be  a  system  effectiveness  requirement  unless 
otherwise  specified.  The  equivalent  system  reliability 
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requirement  is  given  by 


kJ 


R*(T)=^0  {26) 

where  R*(T)  i»  the  eyatem  reliability  requirement  for  T  ayatem  or 
mlaaion  houra  of  operation. 

S*(T)  ia  the  ayatem  effectiveneaa  requirement  for  T  ayatem 
or  mission  hours  of  operation. 

Da  is  the  system  design  capability. 

rIOTE:  If  the  original  requirement  ia  given  in  terms  of  mean 
life  or  failure  rate,  a  value  of  T  should  be  chosen  to 
represent  a  significant  period  of  system  operation 
such  as  average  mission  time  or  average  maintenance 
period.  The  equivalent  system  effectiveness  require¬ 
ment  is  obtained  from  the  equation 

S*(T)  *  e“T/ (27) 
or  | 

j  S*(T)  =  e"^*T  (2*) 

where 

F  *  is  the  original  system  mean  life  requirement. 

~k+  is  the  original  system  lailure  rate  requirement. 
Equation  (26)  is  then  used  to  determine  the 
_  system  reliability  requirement.  _ 

£>  2.  Determine  the  feasibility  of  the  reiiability  requirement  thro'.gh 
consideration  of  past  reliability  performance.  Procedures 
based  on  normalised  complexity  and  environmental  measures 
and  reliability  prediction  by  function  are  appropriate. 


^  This  equation  is  based  on  the  assumption  that  operational  readiness  or 
availability  is  equal  to  one.  Since  availability  is  a  function  of  reliability  as 
well  as  maintenance,  one  must  consider  such  factors  as  the  mission  profile, 
the  ratio  ot  repair  rates  to  failure  rates,  and  the  availability  of  backup 
equipment  in  interpreting  R*  (T). 
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(29) 


^  3.  Obtain  the  total  nystem  failure  index,  K,  by  the  formula 

K  =  K.  +  K,  +  •  •  •  +  K.  +  •  •  •  +  K 
12  j  n 

and  form  the  failure  index  rat'o« 
wj  =  Kj/K 

w2  =  K2/K 

<30) 


■•v  =  K  /K 

n  n 


^>4.  Compute  allocated  unit  reliabilities  from  the  equation 


(31) 


where 


>5. 


ft(t .  )  is  the  allocated  reliability  of  the  j**1  unit. 

1  th 

t  .  is  the  average  operating  time  of  the  j  u..it  during 

1  hours  of  system  operation. 

Ej  is  the  essentiality  of  the  j^unit.  (E^  must  be 

greater  than  1  -  R*(Y)  J.  Units  which  violate 

this  requirement  shall  be  excluded  from  the 

allocation  and  new  values  of  the  w's  obtained. ) 

If  unit  requirements  are  desired  in  terms  of  mean  life  or 
failure  rate  and  constant  failure  rates  are  assumed. 


9r 


t.  = 

j 


4 


log  ft  (t  j  ) 
log  R(tf) 


t. 

J 


(natural  logarithms) 


(32) 


(33) 
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Approximate  Formulae: 

Follow  Steps  1  to  3; 

For  A.  Unit  mean  life  requirements: 


E  t 

XL 


Wj  log  R*  (T) 


(34) 


For  B.  Unit  failure  rate  requirements: 


A  wi  lo8  R*  (T) 

X  * - 

i  Ejtj 


(35) 


For  units  known  to  have  a  failure  rate  which  is  not  constant 
over  time,  an  average  failure  rate  during  the  unit's  t  hours  of 
operation  can  be  obtained  by  the  equation 


* 


j 


A 

1-R(t,) 

*J 


(36) 


4.  4  Final  Steps  (Redundant  Systems) 

i  >  is  section  describes  the  remaining  steps  of  the  allocation  proce¬ 
dure  for  systems  which  contain  a  single  redundant  configuration  consisting 
of  two  u.iits,  not  necessarily  identical,  each  of  which  is  equally  effective  in 
performing  the  required  function--!,  e. ,  modal  design  capabilities  are  equal. 
The  two  types  of  redundancy  considered  are: 

(a)  Active-parallel,  where  bo>h  redundant  units  are  constantly 
energized,  and 

(b)  Standby,  where  one  redundant  unit  is  not  energized  until  the 
operating  redundant  unit  fails. 

The  method  used  for  allocating  reliability  in  these  cases  is  to 
determine  an  equivalent  failure  index  for  the  redundant  configuration  from 
the  failure  indices  of  each  redundant  unit.  This  procedure  will  permit  uti - 
lizrtion  of  the  basic  allocation  formulas.  If  switching  is  involved,  it  shall 
be  assumed  that  the  probability  of  premature  switching  (switching  when  not 
required)  is  relatively  small  as  rnmpareH  to  the  probability  of  failure  to 
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switch  when  required.  The  switching  -mechanism,  thereiore,  can  be 
considered  as  a  series  unit. 

The  unit  identification  notation  shown  in  Figure  7  will  be  used  in 
th’a  section. 

r 


Series  Portion  ^ 

U 

U,  to  U  are  the  series  units 
l  m 

U  ,  and  U  ,  are  the  two  redundant  units 
rl  rZ 

Ur  is  the  redundant  configuration 

FIGURE  7 

NOTATION  CONVENTION  OF  SECTION  4.  4 


The  remaining  steps  of  the  procedure  appear  in  sequence  below: 

^  1.  Determine  the  system  reliability  requirement  by  first  esti¬ 
mating  the  design  capability  of  the  system.  (Follow  Step  1 
of  Section  4.  3  except  that  system  design  adequacy,  D>f  is 
taker*  to  be  the  design  capability  of  each  of  the  two  modes 
of  operation. ) 

2.  Obtain  the  total  failure  index  of  all  scries  units  from  the 
equation 


111 

K*=^ 


(37) 


where 


is  the  total  failure  index  of  the  series  portion 
m  is  the  number  of  series  units. 
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j~y  3.  If  the  redundant  units  are  not  identical,  calculate  an 

equivalent  failure  index  for  each  redundant  unit  from  the 
formula 


i  /•> 

v'  =  r  K  .  •  K  _  I  ' 
r  L  rl  rc  -i 


(381 


where 

ia  the  equivalent  failure  index  of  redundant 
units  having  failure  indices  of  and  K  £  • 

(If  Urj  and  Ur2  are  identical,  K^,  ia  the 
failure  index  for  each  of  them. ) 

4.  Determine  the  feaaibility  of  the  reliability  requirement. 

P>  5.  Calculate  the  ratio 

Ka 

or  =  (39) 


P>  6.  To  obtain  an  equivalent  aeriea  failure  index  for  the  redundant 
configuration, 

A.  With  Active  Parallel  Redundancy; 

Obtain  the  value  Z(cr,  R*)  from  Figure  8  or  9  for  the 
appropriate  set  of  a  and  R*. 

B.  With  Standby  Redundancy: 

Obtain  the  value  Z(  a,  R*)  from  Figure  10  or  11  for 
the  appropriate  set  of  a  and  R*,  and  compute 

Kf  *  Zf  a ,  R*)Ka  (40) 

where  Kr  ia  the  equivalent  series  failure  index  of 
the  redundant  configuration. 

£">  7.  Obtain  the  total  system  failure  index  from  the  equation 

K  =  Ka  +  Kr  (41) 

and  calculate  the  series  unit  and  redundant  configuration  failure 
index  ratios: 


J 
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Wj  =  Kj/K 
W2  »  I^/K 


(*Z) 


w  -  K  /K 
m  m 

w  =  K  /K 
r  t 

as  well  as  each  redundant  unit  failure  index  ratio: 

*,1-  kh/k 

wr2=  Kr2/K 


(43) 


P>  8.  Allocated  reliabilities  for  T  system  hours  of  operation  can  be 
computed  from  the  equations  given  below. 

A.  Series  Units 

The  allocated  reliability  for  the  jth  series  unit  ia 

£(t  )  =  1  -  J  (j  =  1,  2 .  m)  (44) 

J  Ej 

B.  Redundant  Configuration 

The  allocated  reliability  for  the  redundant  configuration  is 


ft,  )  .  1.1=2(1111 


(45) 


where 


t  is  the  average  operating  time  of  the  redundant 


configuration  during  T  hours  of  system  operation. 

is  the  essentiality  of  the  redundant  configuration. 

w  r 

(E  must  be  greater  than  1-R*(T)  .) 
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C.  Redundant  Units 


The  allocated  reliability  for  each  redundant  unit  is 


ft 


.(tj  =  R*(T) 

a  1  r 


ri 


(i  =  1,  l) 


(46) 


If  unit  requirements  are  desired  in  terms  of  mean  life  or  Uilure 
rate,  Step  5  of  Section  4.  3  applies  for  the  series  and  redundant 
units,  provided  the  assumption  of  constant  unit  failure  rate  is 
good.  If  a  constant  failure  rate  is  a  poor  assumption,  average- 
unit  or  redundant  configuration  failure  rate  can  be  allocated  by 
the  equation 


V 


A 

R(t .) 


(47) 


For  the  redundant  configuration,  mean  life  requirements  are 
computed  from  the  following  equations: 

Active  Parallel 

*  •  .  , 

(48) 


r  I 


rf 


A  A 

•  ,  e  , 

r  1  r2 

a - n — 

«  ,  +  6  . 
r  1  r2 


Standby 


$r!  ♦  &r 2 


(49> 


NOTE:  The  time-to-failure  distribution  of  a  redundant 

configuration  is  not  truly  exponential.  $r  ,  there¬ 
fore,  cannot  be  interpreted  as  the  mean  life 
associated  with  a  constant  failure  rate. 


The  average  l&ilure  rate  of  the  redundant  configuration  is 
given  by 

a  1 

$  =  —7 - L  (SO) 
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FIGURE  9 


CHART  FOR  DETERMINING  Z(o,  R*) 

FOR  ACTIVE  PARALLEL  REDUNDANCY 
(R*  =  .  90,  .92,  .94,  .95,  .96,  .98,  .99,  .995) 
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FIGURE  11 

CHART  FOR  DETERMINING  Z(a,  R*) 

for  standby  redundancy 

(R*  =  .90,  .9 2,  .94,  .95,  .96,  .98.  .99,  .995) 
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EXAMPLE C 


BALLISTIC  MISSILE  PAYLOAD  ALLOCATION-^ 


^  CONDENSED  FROM  "A  PRELIMINARY  DESIGN  AID  FOR 
STUDYING  COMPONENT  WEIGHT  ASSIGNMENTS  IN  BALLISTIC 
MISSILE  PA  YU  ADS,  "  By  S.  I.  Firetman,  RAND  Memorandum 
RM-2471,  January  13,  I960. 
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ABSTRACT 


Each  el crr.cn*.  of  o  ballistic  rr*i  =  «> il »•  * «  navload- -warhead.  guidance  and 
penetration  aids--will  increase  in  effectiveness  with  an  increase  of 
weight  allocated  to  the  element.  For  a  missile  that  is  to  be  employed 
against  a  defended  "point"  target,  this  example  presents  a  method  for 
determining  the  optimum  division  of  the  missile's  payload  between  the 
three  competing  (for  weight)  elements,  when  their  individual  weight- 
effectiveness  relationships  are  known.  For  the  case  of  a  single  missile 
per  target,  using  a  most  basic  application  of  the  stepwise  optimization 
philosophy  of  dynamic  programming,  the  problem  is  formulated  as  a 
two-stage  weight  allocation  process.  The  first  stage  determines  the 
optimum  tradeoff  between  warhead  (lethal  radius)  and  guidance  (CEP); 
the  second  stage  determines  the  optimum  divisior  between  penetration 
aids  and  an  optimum  mix  of  waihcad  and  guidance.  The  simple  arith¬ 
metical  method  that  results  is  demonstrated  by  an  example.  The  same 
>p*unzation  process  is  useful  for  the  canes  of  sequential  aid  simul¬ 
taneous  multiple  missile  employment  per  target.  Although  this  design 
optimization  problem  can  be  solved,  functionally,  for  the  modes  of 
missil,  employment  considered,  its  applicabilitv  to  a  real  allocation 
problem  is  confounded  by  the  design,  intelligence  and  employment  rstl 
mates  required  in  the  analysis.  Use  of  this  method  could  show,  however, 
the  influence  of  the  estimate  uncertainties  on  the  optimal  payload 
division  and  could  thereby  serve  as  a  useful  point  of  departure  for 
design  compromises. 
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INTRODUCTION 


1.  0 

When  determining  the  design  parameters  of  an  item  of  equipment, 
it  is  often  desirable  to  employ  a  quantitative  model  that  describes  or  pre¬ 
dicts  the  equipment's  capability  in  terms  of  the  relevant  parameters.  This 
model,  though  sometimes  relatively  crude,  affords  a  means  of  deter¬ 
mining  the  optimum,  or  nearly  so,  set  of  design  parameters.  Ballistic 
missile  payloads  are  a  case  in  point,  where  one  convenient  model  of  capa¬ 
bility  is  the  missile's  potential  ability  to  survive  enemy  defenses  and 
damage  or  destroy  what  is  called,  a  hardened  "point"  target;  given  that  it 
is  delivered  to  the  target  area  in  a  nonfailed  condition.  For  this  model  of 
capability,  the  missile  payload  design-parameter-optimization  process  is 
a  simple  numerical  procedure.  It  is  developed  and  demonstrated  in  this 
example. 

Each  element  of  a  ballistic  missile's  payload--guidance,  warhead, 
and  penetration  aids--will  increase  in  capability  with  an  increase  of  weight 
all  cato'1  to  the  element.  The  ability  to  destroy  a  "point"  target  is  depen¬ 
dent  or.  the  ability  of  the  missile  to  impact  within  the  lethal  radius  of  the 
targsi.  This  destruction  capability,  therefore,  is  dependent  upon:  (a)  the 
guidance  accuracy,  which  can  be  defined  as  a  function  of  the  guidance  sys¬ 
tem  weight,  and  (b)  the  target  lethal  radius,  which  for  a  fixed  target 

hardness  can  be  defined  as  a  function  of  the  missile  warhead  yield,  which 

2/ 

in  turn  is  dependent  upon  the  warhead  weight.  — 

The  ability  to  survive  the  enemy  defenses  is  dependent  upon:  (a)  the 
offensive  tactic  ej  ployed,  (b)  the  types,  characteristics,  andnumbeisof 
the  penetration  aids,  (c)  the  type  of  defense,  its  strength,  and  its  ability  to 
cope  with  the  penetration  aids.  To  determine  the  probability  of  surviving 
enemy  deienses  as  a.  function  of  these  several  variables  is  indeed  a  difficult 


^  The  general  relationship  of  these  factors  to  availability  and  dependability 
is  illustrated  in  Volume  III,  Example  B,  TC-II  Report. 
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tas1-  and  is  presently  further  aggravated  by  many  technical  arm 
operational  uncertainties.  However,  persons  studying  this  penetration 
problem  feel  that,  to  a  first-order  approvim^i  ion,  the  ability  to  survive. 
IC'BM  defenses  can  be  described  as  a  function  of  *he  weight  devoted  to 
penetration  aids. 

Starting  with  the  weight-effectiveness  relationships  for  each  of  the 
competing  (for  weight)  elements,  the  problems  of  determining  the  optimum 
division  of  payload  for  both  single  and  multiple  (sequential  and  simultaneous) 
missile  employment  per  target  will  be  formulated  and  solved  using  a  most 
basic  application  of  the  stepwise  optimization  philosophy  of  dynamic  pro¬ 
gramming.  The  simple  arithmetical  method  that  results  will  then  be 
demonstrated  by  an  example.  Following  that,  the  uncertainties  surrounding 
the  true  operational  context  and  the  difficulties  of  making  precise  pre¬ 
design  performance  estimates  will  be  considered  to  indicate  more  clearly 
the  limitations  on  the  utility  of  the  method  developed. 

2.0  SINGLE  MISSILE  PER  TARf.ET 

2.  1  Problem  Formulation 

fixed  missile  payload,  W,  is  to  be  divided  among  three  systems, 
guidance,  warhead,  and  penetration  aidB.  The  weight  allocated  to  each 
system  must,  for  physical  (and  operational)  reasons,  satisfy  some  mini¬ 
mum  requirement. 


guidance, 

W 

>  w 

g 

go 

warhead, 

w 

>  w 

w 

1 

0 

penetration  aids. 

w 

IV 

1 

p 

Ho 

and  b<"  at  levels  such  that  the  total  payload  is 

g  w  p 

The  intent  of  the  allocation  is  to  maximize  the  missile's  potential  offensive 
capability,  which  is  defined  as  the  probability  that  a  missile  destroys  a 
particular  defended  point  target;  given  that  it  is  delivered  to  the  target  area 
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in  a  nonfailed  condition.  —  Neglecting  reliability  considerations,  since  it 

is  assumed  tnat  each  element  will  be  made  as  reliable  as  possible  for  a 
4/ 

given  weight,  —  this  measure  of  effectiveness  is  given  by 

P=PcPk  (2) 

pg  r  P  (the  missile  survives  enemy  defenses). 

Pk  7  P  (t)  missile  falls  within  the  target  lethal  radius),  i.  e. ,  the 
single-shot  kill  probability. 


These  two  probabilities  are  independent,  and  both  are  functions  of 
Iheir  weight  allocations;  pg  is  a  rronotonically  increasing  function  of  w^  ; 
and  i*  a  nonlinear  function  of  w^  and  .  The  payload  division  pro¬ 
blem  shall  be  formulated  and  solved  using  a  two-step  dynamic  programming 
stepwise  optimization  technique  that  for  this  problem  is  simply  a  directed 
search  over  combinations  of  allocations. 


2.  2  Method  of  Solution 

The  first  stage  in  the  allocation  process  is  to  examine  the  tradeoff 

between  guidance  accuracy  and  warhead  yield  and  determine  the  levels  of 

w  and  w  which,  for  each  fixed  weight  assignment  will  maximize  p.  . 

g  ^ 

r'or  a  circular  normal  impact  distribution  and  assuming  a  "cookie-cutter" 

5/ 

destruction  distribution,  —  p^  is  given  by 


3/ 

— *  In  general,  the  effectiveness  of  each  missile  of  the  type  being  designed 
is  to  be  maximized  with  respect  to  the  characteristics  of  a  particular  class 
of  targets. 

4/ 

Depending  on  the  use  made  of  this  design  aid,  the  weight  estimate  em¬ 
ployed  in  the  analysis  should  either  be  sufficiently  gross  so  as  to  allow  for 
minor  changes  in  design  for  reliability  improvement  purposes  (preliminary 
design  cf  new  system),  or  sufficiently  precise  that  no  changes  in  equipment 
are  likely  (marriage  of  off-the-shelf  items). 

5/ 

—  The  "cookie-cutter"  destruction  distribution  assumes  a  dichotomy  of 
letha’ity  due  to  blast  damage  from  a  nuclear  weapon;  targets  of  a  given  hard¬ 
ness  that  lie  within  the  lethal  radius  of  the  weapon  are  destroyed  while  tar¬ 
gets  outside  the  lethal  radius  (or  "cookie-cutter")  are  not  even  damaged. 
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( 

\ 


pk  =  I  -  2 -|LR/CEP>  (3} 

where 

LR  is  the  lethal  radius  of  the  target  hardness  -missile  yield 
c  orj'binEt’ nn  p  »iH 

CEP  is  the  circular  er  ror  probable  of  the  impact  distribution  (equal 
to  1.  177  times  the  standard  deviation  of  miss  distance). 

For  each  level  of  W  ^  w  +  w  ,  let 

q  w 

>o  o 


p  (W)  -  max  [,.2 -M/CEP)2 

w  s  w  w  J 


(4) 


where 


w 


W  =  w  +  w 
g  w 


’o 

w 


(5) 


Due  to  the  form  of  the  function,  the  problem  ca  finding  that  combi¬ 
nation  of  Wg  and  that  maximizes  p^(W)  can  be  seen  to  be  the  same  as 
finding  the  maximum  ratio  LR/CEP  for  the  given  W. 

i'  /  lotting  the  functions  defining  the  LR  and  CEP  be  LR  =  h(w^), 

and  CEP  r  g(w  ),  the  problem  becomes:  find  those  levels  of  w  and  w 
S  w  g 

that  maximize 


f(w)  = 


h(Ww) 

g(V 


(6) 


subject  to 


w 

g 

«o 

w 

w 

2  ww  ,  and 
o 

w 

+  w  =  W 

w 

K 

Then,  for  the  maximum  level  of  f  (W) , 


Pk  (W)  =  1-2 


[f(W)  max  j 


U) 


( 
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If  h(\v'w)  and  g(v,  )  were  well  behaved  and  duferentiable  throughout 
their  range,  then  analytical  methods  could  be  employed  for  this  problem. 
Thio,  however,  need  not  be  the  case,  as  these  dependencies  could  be  des¬ 
cribed  by  step  functions,  or  indeed  may  be  just  ■  veral  discrete  values 


UOai^IlQt 

For  discrete  levels— ^  of  w  and  w  ,  because  of  the  form  of  f(W), 

gw 

this  allocation  problem  can  be  readily  solved  numerically  using  a  simple 
and  fairly  rapid  search  over  the  range  of  combinations  of  and  w^  pos¬ 
sible  for  each  \V.  Formally,  this  search  process  is  a  basic  app'ication  of 
Bellman's  —  method  of  examining  a  series  of  successive  approximations 
in  policy  space.  This  method  will  be  demonstrated  by  an  example. 


Having  obtained  p^fW)  for  several  levels  of  W,  this  information  can 
be  utilized  to  find  that  level  of  w^  which  will  give 

P(W)  =  max  f  p  (w  )  p.  (W  -  w  ll  (8) 

wXwSW  8  P  P  J 

PQ  P 


Thus  second-stage  allocation  problem  can  he  solved  by  examining 
the  range  ot  possible  allocations  to  w  and  an  optimal  combination  of  w 

b  P  ^ 

and  ww  —  For  each  level  of  (W  -  w^),  the  combination  that  yields  the 
maximum  ;  k  is  known  from  the  first-stage  of  the  problem  and  tnerefore 
the  com!  mat  on  of  (W  -  w^)  and  w^  that  yields  a  maximum  product,  for 
each  level  of  Wr  is  the  optimum  combination.  The  optimization  method, 
which  is  similar  in  nature  *o  that  employed  in  the  first  stage,  /ill  also  be 
demonstrated  in  the  example. 


^  A  discrete  approximation  is  employed  if  the  functions  are  continuous. 

^  Op.  Cit.  Bellman,  Rich»rd,  "Dynamic  Programming,  "  Drinceton 
University  Press,  1957. 


8  / 

-1  If  more  than  one  defense  mode  is  anticipated, 
of  an  appropriate  sub-optimization  process. 


p  (w  )  could  be  the  result 
rs  p 
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MULTIPLE  MISSILES  PEL  TARGET 


3.  0 


3.  1  Simultaneous  Dchveiy 


The  preceding  analysis  was  based  upon  the  use  of  a  single  warhead 
per  missile  and  a  single  missile  per  target.  II  multiple  missiles  of  identical 
design,  each  with  a  single  warhead,  are  employed  simultaneously  against  a 
target,  it  appears  reasonable  to  employ  as  an  objective  function  that  is  to  be 
maximized 

P  z  P  f at  least  one  of  n  missiles  survives  and  destroys  the] 
n  [target  .  J 

Assuming  non-cor related  impact  errors  and  non-additive  destruction  effects, 

this  can  be  written  as 

p„  *  <’> 


where. 


P» 


<n)  .  p 


Survival  of  each  missile  when  n  are  simultaneously 
employed. 


(n)_ 


By  inspection  it  can  be  seen  that  P^  will  be  a  maximum  when 


p  '  p,  is  a  maximum. 
>> 


The  levels  of  w 


,  and  w  that  maximize 
^  is  known. 


(n) 


p  can  be  obtained  as  before,  when  p  ' 
s  'V  1  s 

No  restrictions  are  necessary  on  the  form  of  p^'"'  for  this  analysis, 
but  it  *i!.uuld  be  noted  that  if  multiple  missiles  are  employed  simultaneously, 
they  should  add  mutual  support  to  each  other  in  penetrating  the  enemy  de¬ 
fenses.  It  appears  plausible  to  expect  that  since  the  effectiveness  of  pene¬ 
tration  aids  can  be  expressed  in  terms  of  pounds  of  aids  emnloyed  for  a 
single  missile,  the  same  type  of  relationship  can  be  defined  for  multiple 
missile  employment.  Where  the  preceding  analysis  implicitly  employed 
one  curve  describing  pg  as  a  function  of  w^,  multiple  warhead  employment 
would  lead  to  a  family  of  curves  similar  to  those  indicated  in  Figure  1. 


For  this  case,  then,  depending  on  the  anticipated  employment, 
several  sets  of  optimum  allocations  could  be  obtained  for  each  payload 
weight.  In  order  to  be  of  use  in  the  design  process,  an  analysis  using  the 
method  probably  would  need  to  be  done  when  the  missile  is  in  the  prelimi¬ 
nary  design  stage.  It  does  not  appear  likely  that  the.  number  of  missiles 
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-  t 


3 


(w  ) 

■  P 


Number  of  iuisailet> 


FIGURE  1.  MULTIPLE  MISSILE  SURVIVAL 


that  will  be  employed  against  a  particular  target  would  be  known  at  that 
time.  Indeed,  even  the  number  of  auch  missiles,  to  be  procured  and  em¬ 
placed  probably  would  not  be  known  at  that  time.  Moreover,  because  of 
failures  during  launch  or  powered  flight,  or  because  of  enemy  action,  the 
number  of  missiles  that  is  actually  delivered  simultaneou  ly  to  the  target 
nr.’.,  may  be  different  than  the  number  planned.  Therefore,  a  compromise 
based  perhaps  on  some  plausible  or  conservative  number  of  missiles  per 
target  probably  would  be  necessary. 

In  considering  the  simultaneous  employment  of  purely  penetration- 
aid  missile.’  (no  warhead)  and  purely  warhead  missiles  (no  penetration  aids), 
the  form  of  the  objective  function  employed  above  would  need  to  be  modified 
to 

pn=  1  -  (1  -  P,<m’n)Pk)n  (10) 


where, 

p^(m,  n)  ^  p  ^BUl.vjvai  each  warhead-carrying  missile  when  m 
penetration  aid  and  n  warhead  missiles  are  simul¬ 
taneously  employed.j 

As  before,  will  be  a  maximum  when  p^m’  n^p^  is  a  maximum. 
Under  the  assumptions  used,the  design  of  the  warhead  missile  will  be  opti¬ 
mum  at  the  levels  of  w^  and  that  maximize  p^ ;  and  this  can  be  obtained 
as  before.  On  the  other  hand,  p  n\  in  addition  to  depending  on  the 
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levels  of  m  and  n,  would  be  a  function  of  the  mt*  uciwcc 
and  guidance  on  the  pentration-aid  missile. 


J. 

it  puittl  wUUli  "  HJP 


3.  C 


Sfequential  Delivery 


Multiple  mis*i!e«  can  »1«n  he  employed  in  a  sequential  manner 
against  a  target,  in  this  case,  because  of  maintenance  (a  particular  mistUe 
may  be  "down"  awaiting  maintenance  when  hostilities  begin),  and  the  opera- 
tional  and  reliability  considerations  previously  alluded  to,  it  does  not  appear 
plausible  to  assign  a  rigid  a  priori  sequence  to  a  set  of  missiles  that  are  to 
be  directed  against  a  particular  target.  A  fixed  sequence  could  be  difficult 
to  obtain  operationally. "Therefore,  this  analysis  will  be  based  upon  the 
assumption  that  all  missiles  of  a  class  will  have  the  same  design  parameters 
rather  than  special  payload  designs  geared  to  the  anticipated  sequence  of 
employment.  This  argument  is  strengthened  by  the  consideration  that  be¬ 
cause  of  the  changing  pattern  of  targets  and  of  weapon  demands,  the  number 
of  weapons  to  be  programmed  against  a  target  iz  prebahy  also  time-variant. 
"  ith  these  considerations  in  mind,  then,  the  analysis  will  be  directed  to  find 
an  optimum  division  of  payload  that  is  independent  of  sequence  of  launch  and 
of  the  number  launched. 

Considering  the  first  case  where  two  missiles  are  employed, '  and 
changing  notation  slightly,  for  the  .'irst  missile, 

Pj  =  F  j^fir  st  missile  survives  the  defenses  and  destroys  the  target; 
which  is,  as  before 


(11) 


where 


PB^  #  P  £ first  missile  survives  j 

For  the  second  missile,  assuming  no  additive  effects  of  destruction  so  that 
all  the  are  identical 

(2) 


P2  = 


where,  by  decomposition 

„  (2) 


Pk 


-  p8(2/,,ps(1)  ♦  p<2/,,<i-p.(I,> 


(12) 


(13) 
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whcr  j 


n  <2/1> 

P  8 

p 

* s 

Therefore, 


P  Jmiasile  two  curvives  given  that  miaaile  one  aurvived 
PTmissile  two  aurvivea  given  that  miaaile  one  did  not] 

[survive  J 


P. 


(2/1)  (1) 

*s 


+  P, 


(2/1) 


(1-P. 


(14) 


By  making  the  conaervative  aaaumption  that  the  enemy'a  miaaile 
defenae  haa  no  weaknesses,  e.g.,  haa  no  rate-of-fire  or  atockpile  li imita¬ 
tion  a,  —  it  can  be  atated  that 


Then 


p  <2'i>  = 

ra 

p.'11 

(15) 

PZ  =  Pk 

p.|2/1»p.("  ♦  -  (P.«".2} 

(16) 

=  P1 

p.,2,,»  ♦  .-p.'1'} 
k  * 

*  P1 

whore  it  appears  reasonable  to  assume  that 


(2/1) 


3t  p 


(1) 


(17) 


and  following  from  the  previous  assumptions  about  the  enemy  defenses, 


(2/1) 


•>  P 


(1) 


(18) 


only  if  the  first  missile  damaged  the  defenses. 


9/ 

■u  If  it  is  postulated  that  the  enemy's  defenses  would  have  either  rate-of- 
fire  or  stockpile  limitations,  the  sequential  employment  of  penetration  aid¬ 
carrying  missiles  followed  by  warhead-carrying  missiles  appears  to  be 
interesting.  However,  the  desirability  of  that  tactic  and  the  division  of  the 
penetration-aid  missile  payloads  are  problems  beyond  the  scope  of  this 
example.  Under  the  mode-of-destruction  assumptions  employed  ,th  a  warhead 
missile's  payload  would  obviously  be  designed  for  maximum  p^  as  before. 
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Let 


then 


APS 


p  (2/D 

r3 


P-  «  P.  +  P.  £d 

C  1  1  •  » 


(19) 

(201 


where  it  can  be  reasoned  that  Apg  is  determined  primarily  by  the  enemy 
defenses. 


For  two  missilesj  employing  the  same  destruction  assumptions  as 
before,  it  appears  that  a  reasonable  objective  is  to  maximize 

P  -  P  ^ at  least  one  missile  survives  the  defenses  and  destroys 
the  target] 


=  1  -  (1  -P2) 

=  1  -  (1  -  P^l  -  P,  -Pj  A  Pg) 

=  2Pj  -  Pj2+  P^p,  -  Pj2A  pt 


(21) 


This  means  that  the  over-all  piobability  of  mission  success  is 
dependent  on  both  Pj  and  A  pg  .  But,  A  pg  is  dependent  primarily  on 
the  dcOrses  (how  they  arc  built,  operated,  etc. ),  and  therefore,  the  offense 
should  probably  plan  on  the  worst  case,  which  is  ^pg  =  0.  This  means 
that  th*-  d»£*nses  »r®  totally  unaffected  by  the  employment  of  the  first 
weapon. 

Employing  this  conservative  operational  assumption  then,  the  pro¬ 
blem  becomes  that  of  choosing  levels  of  w  ,  w  ,  and  w  sc  ..s  to  maxi- 

•  g  w  p 

mize 

P  *  2  Pj  -  Py 


This  is  seen  to  be  the  probability  that  either  of  two  missiles  destroyt 
the  target,  if  each  missile  is  of  the  same  design  and  must  penetrate  the 
same  defenses.  This  function  increases  monotonically  with  P. ;  is  a  maxi¬ 
mum  when  Pj  is  a  maximum,  and  therefore,  the  single  missile  per  target 
data  and  optimization  method  are  applicable  to  this  situation.  Although  de¬ 
veloped  for  the  two-weapon  case,  it  can  be  seen  by  induction  that  this  result 


95 


is  applicable  to  all  numbers  of  sequential  missiles  as  long  as  the 
conservative  assumptions  relative  to  effects  or  defenses  and  destruction 
phenomena  remain  reasonable. 

-1.0  AW  EXAMPLE 

Assume  that  for  a  defended  point  target  of  given  hardness,  the 

functions  g(w  ),  h(w  )  and  p  (w  )  are  as  given  in  Figure  2.  The  first 
S  ^  ®  P 

step  in  the  weight  allocation  process  is  to  find  pk(W),  for  several  levels 
of  W.  This  in  done  in  Table  I. 


TABLE  I 

DETERMINATION  OF  MAXIMUM  pk 


w 

(lb) 

_ 

f(W)max 

Optimum 

Sub-Allocation 

[f(W)max|  2 

2-Jf(W)max|2 

Pk(W) 

w 

w 

W 

g 

a 

mm 

200 

300 

mm 

m 

ESI 

ns 

700 

0.  27 

200 

500 

IB 

0.05 

800 

0.  32 

200 

600 

m 

0.07 

900 

0.  34 

300 

600 

0.92 

0.  08 

1000 

0.  38 

300 

700 

0.90 

0.  10 

1100 

0.42 

300 

800 

0.88 

0.  12 

1200 

0.47 

200 

1000 

0.  86 

0.  14 

1300 

0.  54 

200 

1100 

0.82 

0.  1  i 

1400 

0.  62 

200 

1200 

0.  385 

0.  77 

0.23 

on  w  and  w 
g  w 


For  example  f(W)  for  W  =  500  is  fixed  by  the  arbitrary  constraints 

200  lbs.  hence. 


w  =  300  lb  and  w 
K  w 

Bo  o 


f(W> 


W  =  500  = 


0.43  . 


gP00)  "  2.00 


=  f(W)max 
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AND  p  AS  A  FUNCTION  OF  WEIGHT  ALLOCATION 


f<w)|  W=  600 


is  the  maximum  of  the  two  combinations 


h(200)  0. 43  h{300)  _  0. 48 

g(400)  *  i.  75  ’  g(300)  '  2.  00 


f(W>jw  =  70C 


is  the  maximum  of  the  three  combinations 


h(200)  0.43  h  300)  _  0.48  h(400)  0.  52 

g(500)  _  1.57  ;  g(400)  '  1.75’  g(300)  “  05 


As  can  be  seen,  this  process  is  straightforward  and  quite  rapid. 


The  value  of  p^fWJas  a  function  of  W  is  now  known.  The  second 
step  uses  this  maximum  p^  and  the  associated  mix  between  and  ww  to 
obtain  the  maximum  value  of  P,  for  each  level  of  W,  or  a  particular  value 
of  W.  The  procedure  for  obtaining  P(W)  is  shown  in  Table  II  (reference 
equation  8). 

TABLE  II 

DETERMINATION  OF  MAXIMUM  P 


w 

(lb) 

w 

g 

- ry 

Pk(W) 

P(W) 

W 

P 

500 

200 

300  . 

0.03 

-  _ 

-  - 

|  600 

200 

400 

0.04 

-- 

-- 

!  700 

200 

500 

0.05 

0.01 

200 

690 

200 

600 

0.07 

0.02 

200 

900 

300 

600 

0.08 

0.02 

300 

1000 

300 

700 

0.  10 

0.03 

200 

1100 

300 

800 

0.  12 

0.04 

300 

1200 

200 

1000 

0.  14 

0.04 

400 

1300 

200 

1100 

0.  16 

0.05 

300 

1400 

200 

1200 

0.23 

0.  06 

300 

1500 

0.07 

300 

l*  Repeated  from  Table  I. 

^  This  anomaly  is  caused  by  the  jump  of  p^(W)  from  0.05  to 
0.  07,  which  in  turn  is  a  result  of  the  number  of  significant 
figures  employed. 
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For  example  P(W)|  w_  7no  is  fixed  by  the  arbitrary  constraints  on 


w  ,  w  and  w  , 
w  g  p 


>(W)|w=700  *  (V20°>]  [Pi{500)]  =  (°-40)(°-03) 


is  the  maximum  of  the  three  combinations 


P(W)|w_gQQ  is  the  maximum  of  the  two  combinations 

[p,(200)j  [pk(600)j  =  (0. 40)(0.  04) 

[P,(300)j  [Pk(500)j  =  (0. 52)(0,  03) 

P(W)|w_9cq  is  the  maximum  of  the  three  combinations 
ps(200)l  [pk<700)]  =  (0.  40)(0.  05) 

'P-(300)]  fpk(600)l  =  (0.  52)(0.  04) 

P>(400)  pk(500)  =  (0.  60)(0.  03) ,  and  so  forth. 

For  this  example,  Table  II  shows  that  for  the  range  of  payload 
between  500  and  1500  lb,  the  value  of  P  varies  between  0.  01  and  0.  07,  and 
that  the  optimum  w^  varies  from  200  to  400  lb.  Table  II  also  shows  the 
best  allocation  of  weight  to  guidance  and  warhead  for  each  level  of  W. 

To  find  each  optimum  division  consider,  for  example,  that  the 

missile  payload  is  to  be  1200  lb.  For  this  case  one  would  enter  the  table  at 

W  =  1200  lb.  and  ’•ead  from  the  P(W)  column  tha  .  the  maximum  P(1200)  = 

0.  04,  and  this  is  obtained  using  w  =  400.  The  remaining  800  lb  is  to  be 

divided  among  \v  and  w  .  Entering  the  table  again  with  W  =  800  lb.  the 
w  g 

optimum  mix  of  ww  and  w^  is  read  from  tneir  columns  and  is  seen  to  be 

w  =■  200  lb 

w  =  600  lb 

g 

This  information  is  presented  on  Figure  3  for  the  entire  range  of  missile 
payloads  examined. 


99 


(qi  jo  spoapunq)  jqStdM  juauidia 


"2 

u 

i 

£ 

w 

X. 

uo 

•f* 

i 

) 

1 

>> 

4 

CL 

1 


H 

W 

o 

Bi 

< 

H 


2 

r\ 

H 

U 

D 

ei 

H 

13 

Q  C 

(I 
bo 
M 

3 

M 
i> 

a 

H  * 
Z  « 

21 

Oi  41 

si 

Q  « 

<  -a 

3  s 

5  | 

6  s 

u« 
o 
2 
2 

> 

►H 

Q 

£> 

2 


L. 

41 

a 

•o 

V 

X 

u 

(t 


00 

HD  .s 
a  IS 


w 

06 

U 

fl 


100 


100 


S.  0  T, IMITATION'S  ON  IITII  ,fTY  OF  METHOD 

The  method  presented  was  developed  tc  solve  a  specific  set  of 
problems.  It  is  essentially  a  «.mple  method  and  given  the  data  required, 
will  afford  quantitative  results  for  the  optimization  criteria  considered. 

But,  as  was  pointed  out,  the  analysis  is  based  upon  several  design  and 
operational  considerations,  the  very  nature  of  which  will  restric  :he  utility 
of  thf  method  for  design  purposes.  First,  because  of  design,  development, 
and  emplacement  time  and  costs,  it  appears  reasonable  to  expect  that  all 
missiles  of  a  class  wall  he  equipped  with  identical  warheads,  guidance 
packages  and  penetration  aide.  On  the  other  hand,  it  may  be  unreasonable 
to  expect  that  all  the  targets  for  these  missiles  will  have  the  same  vulner¬ 
ability  and  defenses.  A  design  that  is  optimum  for,  say,  the  employment  of 
a  single  missile  against  one  target  combination  of  hardness  and  defense 
capability  may  not  be  optimum*for  the  employment  of,  say,  two  or  three 
missiles  against  another  target  combination.  A  logical  compromise  might 
be,  however,  to  choose  the  design  that  is  optimum  for  anticipated  employ¬ 
ment  against  the  most  important  set  of  targets  and  which  also  retains  a  high 
capability  for  other  targets.  The  method  of  this  example  would  be  useful  in 
this  dcsiy  i  compromise  context. 

Secondly,  the  guidance  accuracy  is,  in  general,  dependent  upon  the 
range  10  target,  and  all  targets  for  a  class  of  missiles  are  certainly  not  at 
the  same  range.  Here  again,  compromise?  wr»*ilH  h*  n^rMnary  if  this 
method  is  used. 

A  more  detailed  analysis  could  possible  be  employed  to  take  account 
of  these  many  intractable  design  and  employment  conditions.  For  example, 
an  analytic  method  probably  could  be  developed  that  would  consider  the  use 
of  the  proposed  missile  against  a  large  group  of  targets  of  varying  worth, 
defense  strength,  and  vulnerability.  In  the  light  of  the  problems  raised 
above  and  during  the  analyses,  however,  it  is  not  clear  that  a  wore  detailed 
analysis  is  warranted.  The  type  of  design  decisions  considered  here  wou’d 
need  to  be  made  early  in  the  R  &  D  program  for  a  missile,  and  would  there¬ 
fore  be  based  on  early  equipment  (e.g. ,  what  will  be  the  aclievable  CEP 


lor  a  given  weight  and  range  to  target)  and  intelligence  (e.g.,  what  defenses 
will  the  enemy  employ  for  each  target)  estimates  and  early  estimates  of 
anticipated  employment  (e.  g. ,  how  many  missiles  will  be  employed  against 
each  target  and  with  what  timing).  Each  of  these  v.onld  change  substantially 
before  the  missile  became  operational,  and  the  design  that  was  optimal 
early  in  the  RID  program  would  ultimately  become  only  a  compromise. 

Perhaps,  then,  the  greatest  worth  of  a  pre-design  analysis  using 
this  method  or  any  similar  method,  is  that  it  would  focus  attention  on  the 
influence  of  the  several  required  design,  employment  and  intelligence  esti¬ 
mates  on  the  optimum  payload  division.  A  quantification  of  thi«  influence 
and  an  analysis  of  the  sensitivity  of  the  design  to  the  range  of  estimate 
uncertainty  could  serve  as  a  useful  point  of  departure  for  design  compro¬ 
mises.  Depending  on  the  degree  of  estimate  uncertainty,  a  sensitivity 
analysis  could  strengthen  the  apparent  utility  of  any  particular  set  of  design 
parameters.  Fortunately,  the  number  of  variables  employed  in  this  analy¬ 
sis  is  sufficiently  small  that  the  effects  of  uncertainty  in  a  particular  esti¬ 
mate  could  be  clearly  seen. 


EXAMPLE  D 


OPTIMIZING  A  PRELAUNCH  CHECKOUT— / 


^  Condensed  from  'MISSILE  PR-t. LAUNCH  CONFIDENCE 
CHECKOUT:  CONTENT  AND  EQUIPMENT  DESIGN 
CRITERIA,  "  by  S.  I.  Firstrran  and  B.  J.  Voosen,  "LAND 
MEMORANDUM  RM-2485-PR,  February  22,  I960. 


ABSTRACT 


This  example  presents  a  procedure  for  determining  the  optimum  test  content 
of  an  fCBM  preiaur.ch  checkout  that  is  subject  tc  >  'J me  constraint  Cost 
considerations  are  not  introduced  as  a  constraint,  but  instead  are  employed 
after  the  text  content  has  been  optimized  for  each  possible  test  duration 
constraint  in  order  to  select  between  designs.  An  example  is  given  and 
references  are  cited  that  contain  an  explanation  of  the  estimation  of  the 
parameters  associated  with  the  design  technique. 
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1.0 


INTRODUCTION 


Most  cor.nolex  weapons  are  checked  prior  io  iheir  employment  so  ns 
to  "be  sure"  that  the  weapon  contains  no  mission -failure -causing  defects  and 
is  in  fact  ready  to  perform  its  assigned  mission.  Though  often  partially 
qualitative  in  nature,  this  check  is  intended  to  establish  "confidence"  in  the 
ability  of  the  weapon  to  perform  its  mission.  Once  a  decision  to  employ  a 
"confidence"  checkout  has  been  made,  engineering  and  operational  evalua¬ 
tions  can  be  employed  to  determine  the  content  of  such  checkouts  and  the 
required  coverage  of  the  checkout  equipment.  This  example  is  concerned 
with  the  problem  of  making  design  decisions  for  time -limited  checkouts  of 
ballistic  missiles  and  develops  (a)  quantitative  criteria  for  the  value  of 
inclusion  of  individual  checks  in  the  checkout,  (b)  an  expression  for  the  re¬ 
quired  efficiency  of  the  checkout  equipment,  and  (c)  a  mathematical  method 
for  determining  the  con  ent  of  a.  theoretically  optimum  «  leckout.  A  brief 
sample  is  included.  The  method  developed  can  also  be  used  to  ascertain 
the  launch  "confidence"  of  existing  systems. 

/  1 

Th  performance  of  a  weapon  is  a  function  of  its  design  and  its 
construction,  factors  that  also  result  in  an  inherent  flight  reliability;  one 
cannot  "check"  performance  or  reliability  into  a  weapon.  For  many  opera¬ 
tional  situations  the  only  reasonable  purpose  of  a  prelaunch  check  is  to 
assure  the  commander  that  the  weapon  is  in  a  design  or  mission-ready 
condition  at  the  time  of  employment.  For  this  reason,  the  te”-.i  "com¬ 
mander's  confidence"  is  defined  as:  the  probability  that  a  missile,  for  which 
a  launch  attempt  is  made,  does  not  contain  a  mission-failure -causing  defect, 
or,  equivalently,  the  probability  that  no  undetected  mission -failure -caus  ,ng 
defects  are  present  in  the  weapon  after  the  prelaunch  checkout. 

This  definition  will  be  formulated  mathematically,  as  a  function  of 
(a)  the  probability  of  a  mission-failure -causing  defect  occurring  in  the 
weapon,  (b)  the  capability  of  the  checkout  to  detect  each  def  >ct,  and  (c)  the 
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possible  deleterious  effects  on  the  weapon  oi  the  checkout,  this  formulation, 
then,  explicitly  accounts  for  the  tradeoff  between  detecting  defects  that  are 
present  prior  to  checkout,  and  oi  introducing  defects  during  the  checkout. 

Th"  resultant  probabilistic  model  employs  estimates  that  are  obtainable  in 
missile  reliability  programs. 

The  object  of  a  "confidence"  check  is  to  maximize  the  commander's 
confidence.  In  general,  if  all  functions  of  a  weapon  could  be  checked  prior 
to  employment,  this  confidence  would  be  a  maximum.  However,  for  most 
weapons,  it  is  physically  impossible  and  operationally  impractical  to  check 
all  functions  of  the  weapon  prior  to  employment.  Ordinarily,  for  ballistic 
missiles  the  checkout  will  need  be  done  within  a  limited  time;  sometimes 
with  a  limited  volume  of  equipment,  or  within  some  other  physical  constraint. 
The  time  constraint  is  usually  dominant,  however,  and  therefore,  the  pro¬ 
blem  addressed  is  that  of  choosing  which  of  the  many  tests  to  perform  within 
the  limited  time  allowed  for  such  prelaunch  checks,  so  a  to  maximize  the 
c«- -licence. 


2.0 


DESCRIPTION  OF  MODEL 


The  first  step  in  developing  the  model  is  to  describe  the  missile 
characteristics  which  affect  the  checkout  decision.  To  do  this,  observe 
that  a  missile  is  composed  of  a  group  of  physical  functions  (power  supplies, 
engine  controls,  fuel  p res sun zation  equipment,  etc.}.  At  some  levs!  thtic 
functions  can  be  grouped  into  a  set  of  independent  functions.  It  is  desirable 
of  course,  to  group  these  functions  into  logical  test  units.  Many  functions 
are  dependent,  i.e. ,  are  connected  and  operated  such  that  an  error  in  one 
propagates  to  other  functions.  Independence,  of  course,  means  that  each 
function,  or  "black  box"  or  group  of  black  boxes,  will  fail  but  will  not  affect 
other  functions  when  it  fails. 


As  an  example  of  independence,  consider  a  power  supply  and  a 
transmitter.  They  are  certainly  functionally  dependent,  but  each  can  fail 
independent  of  the  other  and  could  be  employed  as  independent  functions  in 
this  model. 
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For  one rational  miHuiiits,  the  only  defects  that  must  be  considered 
for  the  prelaunch  checkout  are  thoce  that:  (a)  could  cause  a  mission  failure 
and  (b)  can  be  feasibly  checked  within  the  operational  environment.  It  is 
possible  that  some  funct’ons  are  net  critical  for  mission  success,  and  cer¬ 
tainly,  some  functions,  such  as  separation  bolts,  cannot  be  checked  in  an 
operational  environment.  Using  standard  reliability  estimating  techniques, 
the  following  set  of  probabilities  can  be  estimated  for  each  of  the  missile's 
defects  which  number,  say,  R,  r  =  1,  2,  .  .  .  ,  R. 

=  Probability  that  the  rtlv  defect  does  not  exist  prior  to  checkout, 
i.  e. ,  h?a  not  occurred  since  last  checkout. 

qr  =  Probability  that  the  rth  defect  is  detected  given  that  it  existed 
prior  to  the  checkout,  and  was  checked. 

ry  =  Probability  that  the  rth  defect  is  not  caused  by  being  activated 
(or  execcised)  and  not  checked,  given  that  it  did  not  exist 
prior  to  checkout. 

s^  =.  Probability  that  the  rth  defect,  is  not  caused  by  being  activated 
and  checked,  given  :hat  it  did  not  exist  prior  to  checkout. 

Examination  of  these  proo  i  nifties  will  show  that:^ 

(a)  pr  is  related  to  the  system  reliability,  and  is  simply  the  proba¬ 
bility  that  ti  e  rth  defect  has  not  occurred  sir.ee  the  last  checkout  of  the 
missile.  It  is  dependent  on  the  elapsed  time  since  the  last  checkout. 

(b)  can  be  called  the  efficiency  ol  the  checkout  equipment,  and 

(c)  the  primary  difference  between  rr  and  sr  is  the  level  of  oper¬ 
ating  stress  to  which  the  defect  is  subjected.  For  many  circuits  this  dis¬ 
tinction  may  be  trivial.  Both  rr  and  s^  are  dependent  on  the  time  required 
for  the  complete  checkout,  while  *r  is  also  dependent  on  the  method  of  t'  st 
employed  and  the  time  required  for  the  test. 

These  probabilities  can  be  combined  into  a  "confidence"  function  that 


— ^  Reference  2  contains  both  a  description  of  methods  of  estimat’ng  these 
terms  and  a  quantitative  treatment  of  the  sensitivity  of  the  decision  process 
to  errors  in  these  estimates. 
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will  estimate  the  probability  that  the  weapon  is  in  a  design  or  mission-ready 
condition  when  a  launch  attempt  is  made,  i.  c. ,  the  probability  that  no  un¬ 
detected  defects  exist  in  a  weapon  afte*  checkout. 

If,  during  the  checkout  routine. 

(a)  a  chock  is  made  for  the  rth  defect,  then 

C  ^  =  Probability  that  the  rth  defect  (which  is  checked)  either 
does  not  exist  after  checkout  or  has  been  detected 
is  by  decomposition 

Cr(1)  =  (1-Pr)qr  +  »rPr  +  (1-»r)Prqr  (1) 

=  qr  0  -  pr«r)  +  pr“r  (2) 

This  is  the  sum  of  the  mutually  exclusive  ways  in  whicfi  the  rth  ,\ 
defect,  which  is  checked,  will  either  not  exist  after  checkout  or  be  detected 
if  it  exists.  The  first  term  in  the  first  equation  is  the  probability  that  the 
defect  existed  prior  to  checkout  and  was  detected;  the  second  term  is  the 
i  robability  that  the  defect  did  not  exist  prior  to  checkout  and  was  not  caused 
by  being  checked;  and  the  third  term  accounts  for  defects  being  caused  during 
checkout  and  being  detected.  It  is  assumed  that  the  same  is  applicable 
to  both  situations. 

(b)  a  check  is  not  made  for  the  rth  defect,  but  it  is  activated 
(turned  on  ai.d/or  exercised),  then 

CrU)  =  Probability  that  the  rth  defect  (which  is  not  checked 
but  activated)  either  does  not  exist  after  checkout,  or  has  been 
detected 

ir.  given  by 

Cr(2)  =  (1  -Pr)*p  +  rrPr  +  (1  -rr)pT*r  (3) 

=  »r  (i  -  Prrr)  +  Pp  *r  (4) 

This  i&  the  sum  of  the  mutually  exclusive  ways  in  which  the  rth 
defect,  which  is  not  checked  but  which  is  turned  on  during  ihe  process,  will 
not  exist  undetected  after  checkout.  The  first  term  is  the  probability  that  a 
defect  that  exists  prior  to  checkout  is  found  indirectly.  The  second  term  is 


the  probability  tliat  the  defect  is  not  caused  during  the  checkout  process, 
and  the  third  term  accounts  for  defects  liiai  are  caused,  but  indirectly  de¬ 
tected.  It  is  assumed  that  the  same  is  applicable  to  both  situations. 

The  quantity  a^.  is  a  dependent  variable  of  the  checkout  process.  It 
is  defined  as 

af  =  Probability  that  the  rth  defect  is  detected  indirectly,  given  that 
it  existed  prior  to  the  checkout, 
and  is  assumed  to  be  given  by  the  dichotomy, 

1 1,  defect  marifests  itself  in  an  overt  manner  that  will 
Ibe  seen  during  the  check  of  the  functions  that  are  checked. 


a 


r 


0,  defect  does  not  manifest  itself  in  an  overt  manner 
that  will  be  seen  during  the  check  of  the  functions  that 
^are  checked 


The  val  e  of  a  will  depend  on  what  functions  of  the  system  are 

r  3/ 

checked,  the  checkout  method,  and  system  design. — 


then 


Or, 

(c)  a  check  is  not  made  for  the  rth  defect  and  it  is  not  activated, 
=  Probability  that  the  rth  defect  did  not  exist  prior  to 


checkout,  is  simply, 

c  ,<3»  =  p. 


(5) 


If  xr  and  yr  are  defined  as: 

rth  defect  checked 
rth  defect  not  checked 


3/ 

To  better  understand  ar>  consider  a  check  of  a  radio  transmitter.  If, 

when  the  transmitter  is  turned  on,  the  tubes  don't  light,  or  no  power  is 

emitted,  one  can  deduce  that  either  the  transmitter  or  the  power  supply 

(including  the  linking  cables)  is  at  fault.  A  second  check  would  be  required 

to  determine  which  function  is  faulty,  but  a  _  ,  =  1 ,  in  this  case, 

power  supply 

if  the  transmitter  is  checked,  because  if  the  power  supply  is  inoperative,  a 
check  of  the  transmitter  will  reveal  this  condition. 
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and 


(  I,  rth  defect  activated  {net  checked) 

\o,  rth  defect  not  activated  (not  checked) 

then  the  confidence  function,  C,  the  probability  that  none  of  the  independent 
defect*  exist  undetected  after  checkout,  is  the  product  of  the  C  ^  above, 
that  is  pertinent  to  each  defect  r.  By  definition,  assuming  independence  of 
terms,  R 

C  =  IT  [q  (1-P  •  )  +  p  sr]  r  [»  (1-p  r  )  +  p  r  /r(p  )  r  ** 

r*  1  r  r  r  r  (6) 


By  taking  the  natural  logarithm  of  C,  the  following  expression  is 


obtained: 


In  C  -  £  [x  ln(q  (1-p  s  )  +  p  s  )  +  y  ln(a  (1-p  r  )  +  p  r  ) 

r=l  r  r  r  r  r  7  r  1  r'  *r  r  *r  r' 


+  (1_xr“yr)In  Pr  ^ 


(7) 


As  all  functions  in  a  missile  must  be  activated  (with  the  possible 
exception  of  some  fuzing  equipment  in  the  re-entry  vehicle  and  items  such 
as  stage  separation  mechanisms)  prior  to  launch,a  function  may  be  checked 
or  not  checked,  but  it  must  be  turned  on  prior  to  launch;  therefore. 


x  -  1  y  =  0 

r  7  r 

v  =  1  ■■=>  x  =0 

■  r  r 


and  moreover 

xr  +  yr  =  i 

Employing  the  third  relationship  between  xy  and  yr 
Yr  s  1  -  .'<r  ).  the  natural  logarithm  of  C  becomes 


(i.  e. ,  by  observing  that 

4/ 


In  C 


R  f 

L  f  x  In 
r=  1  V  r 

N 


qr  (*  -  Pr»r)  ♦  Pr»r 

rr  (1  •  Vr*  +  prrr 


+  ^  (Pr*r  +  »r  (l*Pr 


\ 


(8) 


^  An  implicit  assumption  on  the  nature  of  rr  is  required  for  this  formu¬ 
lation,  It  is  assumed  that  rr  is  the  same  for  all  situations  involving  check 
of  associated  systems. 


Ill 


As  stated,  for  a  ballistic  missile  prelaunch  checkout,  the  intent  is 

to  maximire  C,  and  hence  In  C.,  subject  to  the  single  dominant  constraint, 

which  is  time.  This  means  that  the  "confidence"  maximization  problem  is 

♦o  choose  a  set  of  x  =  1,  such  that  In  C  is  a  maximum  and  Z  x  t  <  T, 
r  r  r  r  — 

where  T  is  the  time  allowed  for  checkout,  and  tr  is  the  time  required  to 
perform  the  rth  check. 


3.0  TECHNIQUE  OF  SOLUTION 

The  first  step  in  the  process  of  deciding  which  become  1  and 
which  remain  at  zero,  is  to  observe  the  nature  of  the  ratio, 

q(l-pt)  +  ps 
*r  r _ rr  r 

a  (1  -  p  r  )  +  p  r 
r  rr  r  rr  r 

This  is  the  ratio  of 

P  [rth  function  contains  no  undetected  defect  if  checked] 

P  [rth  function  contains  no  undetected  defect  if  rot  checked] 


If  this  ratio  is  <  1,  then  its  contribution  to  In  C  is  <  0.  Moreover, 
if  the  ratio  is  <  1,  then  a  check  of  the  rth  function  (or  defect)  could  do  more 
harm  to  the  system  than  good.  This  situation  could  arise  in  missiles,  where 
the  prelaunch  life  of  the  missile  is  spent  in  essentially  »  "shelf"  nr  non- 
operative  condition,  and  could,  for  many  systems  ("specially  mechani¬ 
cal  systems  Fuch  as  rocket  engines)  be  essentially  unity. 

By  this  reasoning,  then,  it  can  be  determined  that  the  rth  function 
(or  defect)  should  not  be  checked  unless 

q(l-ps)  +  p*>a(l-pr)  +  pr 

'  *r  r'  rr  r  r  1  *r  r'  *r  r  (9) 


For  ar  =  0,  the  above  criterion  means  that  before  one  would  con¬ 
sider  checking  the  rth  function,  the  checkout  efficiency  for  the  rth  function, 
qr ,  should  be 


*r  >  TTp  5~~ 

rr  r 


(r  -  s  ) 
'  r  r' 


(10) 
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V 


For  a  =  1,  in  a  similar  manner,  q  must  be  such  that 


a  ( 1  -  p  r  )  +  p  r  -ps 
r  rr  r  rr  r  rr  r 

qa  > - rr 


p  8 
rr  r 


which  gives 

qr  >1 

which  is  physically  impossible. 


(11) 


(12) 


These  two  bounds  on  can  both  be  employed.  For  ar  =  0,  which 
means  that  in  order  to  find  the  rth  defect,  an  explicit  check  must  be  per¬ 
formed,  qr  given  by  Equation(lO),  is  a  lower  bound  on  the  checkout  effi¬ 
ciency  and  can  be  employed  as  a  design  criterion  for  the  checkout  equipment. 
In  order  for  the  checkout  equipment  to  be  fruitfully  employed,  it  must  be  at 
least  this  good. 

For  af  =  1,  which  means  that  because  of  the  other  checks  that  are 
being  performed,  the  rth  defect  will  be  detected  (if  it  exists),  the  lower 
Lound  on  qr  was  seen  to  be  q^  >  1.  This  is  clearly  impossible  and  the 
reason  for  this  result  is  apparent.  If  the  existence  of  the  defect  can  be 
detected  *ml5citly,  there  is  no  reason  to  make  an  explicit  check  for  it. 

This  means  that 

ar  =  1  xr  =  0 

is  a  valid  condition. 


Employing  the  above  condition  on  ay  and  makes  it  possible  to 
view  the  problem  of  what  to  check  so  as  to  maximise  In  C  as  a  two-stage 
time  allocation  problem.  The  first  stage  will  determine  which  tests  are 
best  performed  if  each  must  be  done  explicitly,  then  the  second  stage  will 
take  account  of  the  dichotomy  between  a,  and  x_  to  improve  the  initial 
solution. 


4.0  FIRST  STAGE  OF  ALLOCATION 

First,  for  only  those  r  for  which  the  checkout  equipment  can  achieve 

a  checkout  efficiency  as  given  by  Equation  (IQ),  it  shall  be  assumed  that  all 

a  =  0  and 
r 
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(13) 


Z,(T)  =  In  C  -  I  In  p 
1  r  r 

shall  be  maximized  subject  to 

T  >  Z:c  t 
-  r  r  r 


=  E  y  In  p^-PrV  +  PrV] 

r  r  L  Prrr  J 


(14) 


Observe  the  nature  of  the  term  in  brackets.  For  a  particular 
function/defect,  and  for  a  particular  operational  philosophy  and  test  concept, 
this  term  is  merely  a  parameter.  The  problem  as  stated,  then,  is  to  maxi¬ 
mize  a  linear  function,  subject  to  a  single  linear  constraint. 

The  problem  of  choosing  which  x^  =  1  is  now  of  linear  programming 
(T.P)  form,  and  as  just  one  constraint  is  being  employed,  the  problem  be¬ 
comes  an  LP  problem  of  the  Knapsack  type^  and  is  readily  solved  in 
graphical  form.  For  the  defects  r  =  1,  2,  .  .  .  ,  R,  each  of  which  has  an 
associated  In  [  ]r»  and  t^,  plot  the  set  of  ty,  In  [  as  follows^ 


■5/  The  notation  In  [  J  will  be  employed  instead  of  the  cumbersome  term 

-  "  prv  ♦  Pr-r  I 


In  i 


I  <3  U 

t 


l' 


P  r 
*r  r 
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Now,  the  problem  is  tc  select  a  subset  of  these  points  that  represent  the 

set  of  defects  (or  functions)  that  are  to  be  checked  in  a  time-limited  check- 

(1' 

out.  Then,  as  done  by  Dantzig,  '  rotate  clockwise  a  ray  with  the  origin 
as  pivot  point  and  in  [  ]  axis  as  starting  position.  Tests  corresponding 
to  points  swept  out  by  the  ray  are  selected  in  turn  until  the  sum  of  their  test 
times  meet  or  just  exceed  the  time  limitation.  If  for  the  jth  test  the  time 
limitation  would  first  be  exceeded,  a  decision  must  be  made  as  to  whether 
that  test  should  be  conducted  and  the  checkout  time  lengthened  by  a  small 
amount,  or,  whether  that  test  should  be  excluded. 


The  logic  of  thiB  decision  process  is  simply  that  those  tests  with  the 

greatest  value  per  unit  time  are  the  first  chosen  for  the  set,  i.  e. ,  those 

tests  with  the  largest  value  of  In  [  1  It  are  chosen  until  E  t  =  T.  To 

t  r  r 

these  tests  chosen  by  r  ,  then,  the  value  of  Zj(T)  becomes 


Z,  (T) 


=  E 
r 


In 


qr(* 


P  *  ) 
rr  r' 


■> 

P  • 

rr  r  l 


P  r 
rr  r 


(15) 


5.  0  SECOND  STAGE  OF  ALLOCATION 

The  econd  stage  in  the  time  allocation  process  is  to  determine  how 
the  confidence  can  be  improved  by  letting  some  ap  =  1,  i.  e. ,  by  getting 
some  test  information  free.  The  second  stage,  then,  is  concerned  with 
maximizing  the  entire  confidence  function,  and  can  be  represented  syrri- 
bolically  by  the  quasi -functional  equation 

Z,  (T)  =  Max  [R  (t,)+  Z.  (T  -  t,)j  (16) 

2  0<t2<T  22  1  2 

where 

R2(t2)  =  Z  In  kp(l  -  Pprr)  +  Pprp]  (17) 

r 

where  t2  is  time  allocated  to  second  stage. 

For  each  level  of  T,  implicit  time  will  be  assigned  to  the  second 
stage,  R2(t2),  so  as  to  maximize  the  sum  of  the  two  stages.  This  meanc 
that  if,  say,  an  ap  =  1  is  brought  in,  the  corresponding  xp  =  0 ,  and  another 
check  could  possibly  then  be  performed  in  the  time  which  was  previously 
allocated  to  the  rth  check. 
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It  will  be  advantageous  to  allow  an  ag  to  become  one,  if  during  the 
first  stage  the  corresponding  x  became  one,  only  if  the  other  check,  say 
the  tth  check,  which  could  then  be  performed  in  the  time  prc\-ously  allocated 
to  the  sth  check,  would  cause  the  combined  contribution  of  the  sth  and  tth 
check  to  be  greater  after  a#  and  x^  became  1.  For  the  cases  when 
t^  ^  tt»  see  Figure  2. 


In  [  ]f 


FIGURE  2.  PLOT  OF  In  [  ]  VS  t  WHEN  t  >  t, 

r  r  »  i 

It  can  be  shown  that^  it  is  always  advantageous  to  let  x^  =  1  and 
obtain  the  benefit  of  a^  =  1. 

Similarly,  for  the  third  case,  when  t.  >  t  ,  let  x  *  1  and  a  =  1 
•  t  s  t  s 

if,  and  onU  if, 

%  ( 1  -  Pt»t)  +  Pt*t 

f(At)  <ln  ^ - —  -  In  (qg  (1  *  P,«,)  +  P,s,). 

- 118) 

where  f(  At)  can  bo  viewed  either  as  the  loss  due  to  moving  the  ray  counter¬ 
clockwise  or  the  gain  which  could  otherwise  be  obtained  by  the  use  of  t^  -  tB . 
This  function  is  readily  tabulated  for  each  physically  possible  such  combina¬ 
tion  of  s  and  t. 

The  preceding  statements  of  conditions  for  substituting  test  t  for 
test  s  in  the  set  of  xr  =  1,  will  also  hold  if  several  tests  are  required  to 
allow  some  ag  =  1. 

^  See  Reference  2, 
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The  results  of  the  preceding  analysis  allow  the  second  stage  of  the 
allocation  problem  to  be  solved  in  an  iterative  manner.  Given  the  plot  of 
In  [  "]  r  y*.  t  ,  the  iterative  procedure  is: 

1.  Look  for  any  conditions  of  dependence  that  have  already  been 

satisfied  If  some  x  =  1  and  this  allows  an  a  =1,  where 

t  s 

both  s  and  t  are  contained  in  the  set  of  x  =1.  then  a  =  1, 

r  '  s 

arid  move  the  ray  down  by  an  amount  tg  . 

2.  Repeat  step  1  until  no  more  such  situations  can  be  found. 

3.  Search  for  other  defects  which  have  property  =  1  =>■  ag  =  1, 

such  that  tt  £  tg  ,  and  s  is  of  the  set  =  1  and  t  is  of 

the  set  =  0.  Substitute  the  tth  test  for  the  sth  test  and 
move  ray  down  by  an  amount  tg  ■  lt  • 

4.  Repeat  steps  1,  2  and  3  until  no  more  such  situations  can 
be  found. 

5.  search  for  other  defects  which  have  prop.  rty  =  1  ag  =  1, 
such  that  tt  >  tg  ,  and  »  i»  of  the  set  x  =  1  and  t  is  of 
the  set  xf  =  0.  If,  as  previously  defined,  f  (  ^t)  exists,  or 
potentially  exists,  and  if  Equation  (18)  holds,  then  let  x^  =  1; 
otherwise,  leave  xt  =  0. 

w.  Repeat  eteps  1,  2,  3,  4  and  5  until  no  more  such  situations 
can  be  found. 

6.0  CONDITIONS  OF  OPTIMUM  SOLUTION 

This  iterative  procedure  will  lead  to  a  solution  that  can  readily  be 
seen  to  be  optimum  under  three  situations;  either  (a)  all  conditions  of 
dependence  have  been  utilized,  such  that  all  possible  ar  =  1,  or  (b)  th  >se 
that  have  not  bee,  utilized  are  obviously  not  permissible,  or  (c)  the  use  of 
those  not  utilized  would  obviously  no'  imnrnve  the  confidence. 

Under  conditions  other  than  these  three  extremes,  the  resultant  set 
of  xr  =  1  cannot  be  proven  optimum,  and  indeed  may  not  be  optimum  due  to 
the  possibility  that  some  unique  combination  of  tests  could  be  better  employ¬ 
ed.  In  this  case,  the  answer  obtained  is  at  least  a  good  and  useable 
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approximation  to  an  optimum  solution. 


Each  p^  will  decrease  independently  as  a  function  of  time  since  last 
i  neckout,  while  qf.  r^,  ^  and  will,  in  genera',  1  >  main  constant  for  a 
given  test  method  and  equipment  design,  Therefore,  especially  for  elec¬ 
tronic  systems,  it  would  probably  prove  profitable  to  consider  several  levels 
of  time -vince -last-checkout  when  using  the  model  to  see  if  any  changes  in 
optimum  routine  will  occur.  These  would  require  a  design  compromise, 
and  the  method  of  handling  such  possibilities  is  discussed  in  Reference  2. 


7. 0  APPLICATION 

This  section  demonstrates  the  application  of  the  checkout  model  to  a 
hypothetical  single-stage  missile  that  is  based  on  designs  of  several  present 
ballistic  missiles,  /.’though  the  illustration  has  been  confined  to  less  than 
150  functions,  all  major  functions  of  an  actual  operational  missile  have  been 
included;  i.e.,  a  radio  guidance  system,  control  systen  power  supply,  etc. 


7.  1  General  Procedure 

There  are  four  general  steps  for  determining  whr.t  to  check. 


1.  Aggregate  missile  functions  into  independent  functions /defeats 
using  a  functional  block  diagram  of  the  system. 


2. 


3. 

4. 


Obtain  the  necessary  probabilities  py,  rr>  and  sr  from  reli¬ 
ability  information,  and  from  the  ground  support  equipment 

designers  obtain  the  time  tc  perform  each  check,  *  ,  and 

7/  r 

the  estimated  efficiency,  q  .  — 


Evaluate  in 


qr(1  ’  Pr'r1  + 


P  * 

rr  r 


p  s 
rr  r 


for  each  test  unit. 


Plot  In  1  I  versus  t  and  determine  the  functions  to  be 


•'r 


checked  within  the  time  constraint,  as  described  in  the 


*7  t 

■“  Reference  2  contains  discussion  of  methods  to  estimate  each  of  these 
terms. 


preceding  section.  — 


This  procedure  is  applicable  to  all  functions  that  are  candidates  for 
use  in  the  model.  Some  functions  will  be  handled  outside  the  model.  Fov 
instance,  there  may  be  a  military  requirement  to  check  a  destruct  system 
or  some  "fail  sate"  system,  regardless  of  its  reliability.  These  items  ob¬ 
viously  would  be  handled  outside  the  model.  The  time  to  check  these  func¬ 
tions  would  be  subtracted  from  the  total  time  allotted  for  the  confidence 
check.  The  remainder  would  be  the  time  available  for  checks  of  the  defects. 

7.  2  Independent  Defects 

As  previously  stated,  the  functions /defects  considered  must  be 
independent.  This  requirement  can  usually  be  satisfied  at  some  level  of 
aggregation.  If  possible,  however,  aggregations  should.be  made  consistent 
with  the  selection  of  test  units.  A  test  unit  will  usually  be  what  is  common¬ 
ly  referred  to  as  a  "black  box"  or  series  of  black  boxes. 

In  one  respect,  all  function*  of  a  missile  are  dependent  aince  the 
failure  of  any  part  of  the  basic  system  will  cause  the  mission  to  fail,  or  at 
Ifast  will  degrade  the  effectiveness.  Most  function.,  are  independent,  how¬ 
ever.  in  a  failure  sense.  For  instance,  a  failure  in  an  amplifier  channel 
will  not  be  dependent  upon  a  failure  in  the  gyro.  If,  however,  the  failure  of 
an  amplifier  channel  would  cause  a  failure  of. some  other  function,  say  the 
hydraulic  servo,  the  failures  would  be  dependent  and  should  be  aggregated 
into  a  single  defect. 

As  an  example,  Figure  3  is  a  copy  of  part  of  an  actual  block  diagram 
of  the  control  system  for  a  current  ballistic  missile.  The  servo  amplifier, 
hydraulic  servo,  and  follow-up  potentiometer  are  considered  dependent  in  a 
failure  bCL.se  because  the  design  is  such  that  a  failure  in  any  one  function 
will  cause  a  failure  in  the  other  functions.  Therefore,  the  functions  are 
aggregated  in  Figure  4  as  Defect  117  (see  Figure  4  for  defect  coding  system 
for  the  entire  missile).  In  contrast,  a  failure  of  the  yaw  rate  gyro  (107) 


Of  p  ■% 

■*“  The  sum  o i  tne  [  jr  terms  is  plotted  for  tests  that  can  be  done  simul¬ 

taneously. 
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FIGURE  3.  FLIGHT  CON.  x  L  SYSTEM 
BLOCK  DIAGRAM  (PARTIAL) 


FIGURE  4.  DECISION  GRAPH 
(1  WEEK  AFTER  PERIODIC) 
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will  not  cause  a  defect  in  the  amplifier  channel  (113)  u  checked  separately. 
Therefore,  the  gyro  failure  is  considered  to  be  independent  of  other  failures. 

One  method  for  determining  the  dependence  or  independence  of  each 
function  is  to  consider  separately  for  each  function  ur.  the  functional  block 
diagram,  whether  if  it  fails,  will  that  failure  cause  a  failure  in  some  other 
function?  If  the  answer  is  yep,  then  the  functions  must  be  aggregated  in 
this  model. 

Ufiine  this  type  of  analysis,  the  functional  block  diagram  of  each  of 
the  systems  under  consideration  can  be  redrawn  into  independent  defects. 

A  comparison  of  the  solid  and  dashed  lines  on  Figure  3  shows  that  for  this 
control  system  there  was  little  change.  All  systems  used  in  the  illustration 
required  about  the  same  amount  of  aggregation.  However,  they  will  not  be 
shown  in  this  brief  example. 

7.  3  Determining  What  To  Check 

After  the  data  has  been  accumulated,  the  paramc  er  In  [  Jr  can  be 
ccnputed  for  each  function  and  plotted  r.gainst  the  parameter  time  for  check, 
tf.  Tabic  I  contains  the  data  for' the  flight  control  system  for  pf ,  based  on 
four  weeks  since  the  last  periodic.  This  data  and  similar  data  for  the 
balance  of  t tie  missile's  subsystems  are  plotted  on  Figure  4.  As  previously 
described,  by  rotating  a  ray  clockwise,  checks  are  selected  in  turn  until 
the  sum  of  the  checkout  time  meets  the  time  limitation.  Since  only  those 
tests  with  the  greatest  "value"  per  unit  time  arc  chosen,  confidence  will  be 
maximized.  The  one,  two  and  three  minute  "best"  checkout  times  are 
shown  on  Figure  4. 

7.  4  Design  Decision  Context 

It  is  anticipated  that  this  model  and  decision  process  will  prove  use¬ 
ful  as  a  check  on  existing  designs,  to  ascertain  the  estimated  confidence 
afforded  by  existing  designs,  and  also  as  a  preliminary  design  tool.  This 
design  utility  is  envisioned  as  occurring  in  a  process  as  follows  (see 
Figure  5). 

A  decision  is  made  to  perform  a  prelaunch  checkout  on  a  particular 
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FLIGHT  CONTROL  SYSTEM  DATA 


PRCLiMiNAffT  CQUIPM!  ANALYSIS  I  +  I  MODEL; 
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FIGURE  5.  DESIGN  DECISION  CONTEXT 


missile.  Unknown,  at  this  point  in  time,  is  the  method  by  which  the 
checkout  will  be  performed,  what  missile  capability  the  checkout  will 
assure,  ard  what  checks  will  he  dene  to  obtain  this  capability. 


#> 
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The  AGE  designers  are  told  to  perform  a  comparative  analysis  of 
alternative  mear  s  of  performing  the  prelaunch  checkout.  For  this  hypo¬ 
thetical  design  process,  three  control  means  that  arc  representative  of  ' 
three  control  and  resultant  design  concepts  are  selected  for  study;  these 
are  digital  computer,  punched  paper  tape  and  manual.  Each  is  represen¬ 
tative  of  a  control  mechanism  in  a  particular  test  logic  and  control  realm. 

A  preliminary  design  analysis  is  conducted  using  each  of  the  three 
dusign  concepts.  This  preliminary  analysis  should  consider:  (a)  ths  pro¬ 
blems  of  how  best  to  check  each  function  within  each  design  concept;  (b) 
test  point  availability  and  added  weapon  weight  due  to  additional  test  leads; 
(c)  the  equipment  requirements  /stimulus  and  measurement)  for  w-ach  func¬ 
tion  test;  and  (d)  estimates  of  the  relevant  parameters  for  each  test. 

For  several  levels  of  checkout  time  /constraint)  the  rhecirrmt  mode! 
would  then  be  employed,  using  each  design  concept  in  turn,  to  choose  the 
optimum  set  of  tests  to  perform  from  the  set  of  tests  that  are  competitors 
for  mance.  Then  using  the  confidence  function  the  maximum  confi¬ 

dence  could  be  estimated  for  each  combination  of  design  concept  and  timei^ 

This  maximum  estimate  "confidence."  can  be  plotted  as  in  the  upper 


9/ 

It  will  probably  prove  true  that  this  design  process  will  be  an  iterative 
procedure.  An  analogous  process  is  the  weight  allocation  among  systems  of 
a  missile.  Initially,  preliminary  weight  allotments  aye  made,  and  designs 
are  initiated  with  these  weight  restrictions  in  mind.  After  a  first  cut  a:  the 
systems  designs,  a  revised  weight  budget  is  considered.  In  a  similar  man¬ 
ner,  the  times  to  pci  form  individual  tests  are  initially  estimated.  If,  after 
some  design  effort,  it  appears  that  some  of  the  initial  estimates  were  in 
error,  the  checkout  content  problem  should  be  reconsidered  using  the  re¬ 
vised  time  estimates.  The  same  lype  of  arguments  can  be  raieed  for  esti  - 
mates  oe  pr ,  qr  ,  rr,  and  sr .  This  design  modification  procedure,  it  is 
realise  ',  feasible  only  until  the  design  must  be  fixed.  Thereafter,  sys¬ 
tem  - -.-iific  •  tion  becomes  much  more  expensive,  both  in  time  and  dollars, 
and  ti.  *  considerations  could  override  any  desired  design  changes. 
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graph  of  Figure  5.  As  indicated,  the  optimum  checkout  is  known  for  each 
point. 

Following  this  model  exercise,  a  preliminary  coat  analysis  would  be 
performed.  This  wo<>ld  result  in  a  plot  of  the  nata  such  as  the  lower  grapi, 
of  Figure  5. 

Now  a  decision  of  what  checkout  system  to  design  or  procure  can  be 
made  within  the  context  of  estimated  conlidence,  time  and  dollars.  The 
trade-offs  between  these  elements  and  also  between  degrees  of  equipment 
automaticity  are  explicitly  shown.  Other  considerations  which  can  also  be 
brought  to  bear  upon  the  design  and  procurement  problem  are  the  operation¬ 
al  concept,  maximum  budget,  site  manning  philosophy,  desire  for  standard¬ 
ization,  etc.  In  this  overall  cost-logistics -operational  context  the  design 
decision  can  be  objectively  made,  and  the  checkout  model  is  seen  to  be  an 
integral  part  of  this  design  and  decision  process. 

It  is  seen  that  in  this  analysis,  system  cost  >  ’  not  used  as  a  design 
constraint,  but  is  employed  after  the  design  is  optimized  for  each  level  of 
checkout  time  to  choose  which  design  to  procure.  In  this  manner  the 
design  is  optimum  with  respect  to  the  true  operational  constraint,  name1.’/ 
time  for  checkout,  and  the  effects  of  increasing  or  decreasing  the  budget 
for  a  given  checkout  lime  can  be  observed. 
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ABSTRACT 


The  availability  of  a  system  subjected  to  a  sequence  of  calendar  spaced 
checkouts  is  considered.  Formulae  lor  calculating  the  optimum  fre¬ 
quency  of  checkout  are  given  for  the  situation  which  considers  checkout 
time  as  down  time.  Imperfect  repair,  imperfect  checkout,  and  re¬ 
source  limitations  are  treated.  A  technique  for  the  estimation  of  two 
parameters  of  the  availability  model  is  also  given. 
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1. 0  INTRODUCTION 


U 

In  the  not -too -distant  past,  when  a  new  weapon  system  (usually  a 
manned  aircraft)  was  phased  into  the  Air  Force  inventory,  scheduled  main¬ 
tenance  requirements  were  typical1*/  approximated  by  extrapolating  from 
experience  on  previous  similar  systems.  With  few  exceptions  the  indicator 
used  was  flying-hours,  which  usually  gave  a  fair  measure  of  the  amount  of 
activity  a  system  had  experienced;  the  necessary  maintenance  r  Mention  was 
predicated  on  this  indication.  More  importantly,  the  flying  program  exer¬ 
cised  all  or  nearly  all  systems  and  subsystems  in  a  manner  closely  related 
to  expected  wartime  actions,  thus  verifying  the  condition  of  the  weapon  sys¬ 
tem  generally,  and  bringing  defects  to  light  when  and  where  they  existed. 

The  introduction  of  large,  complex  missiles,  major  portions  of 
which  are  normally  inert,  has  changed  this  picture  considerably.  Since 
these  systems  do  not  fly  periodically,  critical  defects  may  remain  hidden 
for  unacceptably  long  periods  of  time  unless  appropriate  means  for  identi¬ 
fying  them  ire  developed  and  applied.  This  section  is  concerned  with  one 
aspect  of  the  problem,  namely,  the  quantitative  relationship  between 
checkout  frequency  and  readiness. 

2.0  A  SAMPLE  PROBLEM 

The  problem  of  how  ofter  to  "exercise"  (i.  e. ,  verify  tvs  launch 
readiness  of)  a  ballistic  missile  or  its  systems  is  a  knotty  one.  On  the  one 
hand,  an  "exercise"  may  take  the  system  off  alert  for  the  time  required  to 
perform  it.  The  "exercise"  may  also  cause  a  failure  in  a  good  system, 
and  result  in  further  downtime  required  to  repair  the  system.  These  pro¬ 
blems  respond  to  a  very  simple  solution --namely,  fewer  operational 


^  The  relationships  of  availability,  dependability,  and  capability  are 
discussed  in  Volume  II  of  the  TC-II  Report. 
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On  the  other  hand,  undiscovered  failures  also  have  to  be  considered, 
because  failures  can  occur  while  the  system  is  standing  in  a  ready  condition, 
on  alert.  Many  of  these  undiscovered  failures  can  be  found  only  by  conduct¬ 
ing  operational  exercises.  Again  the  answer  to  U:e  problem  is  simple:  to 
cope  with  undiscovered  failures,  conduct  more  operational  exercises;  they 
will  become  evident  and  be  corrected  (though  one  or  more  new  oner  may 
occur  in  a  short  time).  Clearly,  these  two  simple  solutions  are  mutually 
incompatible,  in  fact,  the  problem  resolves  into  one  of  deciding  w'ueie  Lite 
optimum  position  is  between  too  many  and  too  few  exercises. 

We  will  restrict  our  attention  here  to  systems  whose  failures  occur 
exponentially.  This  characteristic  failure  pattern  has  been  the  subject  of 
many  discourses  on  statistical  methods  and  models.  (One  of  the  more 
easily  understood  mathematical  cerivations  for  it  appears  in  a  RAND 
Research  Memorandum  by  R.  R.  Carhart/1^  who  notes  that  the  words 
"random",  "accidental",  "chance",  and  "Poisson"  have  all  been  used  to 
describe  this  type  of  failure  distributing,  whose  formal  designation  is  a 
negative  exponential  distribution  of  failures. ) 

Historically,  it  has  been  found  that  many  components,  subsystems, 
and  systems  experience  exponential  failures.  The  most  detailed  analysis 
wan  Conducted  by  D.  J.  Davis,'  '  who  found  that  the  exponential  failure 
distribution  characterized  a  wide  variety  of  devices,  from  ball  and  roller 
be&rirgs,  vacuum  tubes,  and  many  other  electronic  systems  and  compo¬ 
nents,  to  passenger-bus  motors  and  airborne  radar  systems.  Boodman^ 
presented  further  studies  on  airborne  radars,  and  Lusser^  showed  in¬ 
formation  which  added  naval  torpedoes  to  the  list.  More  recently,  the 

/  5  t 

Atlas  1CBM  was  shown  to  display  this  behavior. '  ' 

The  operational  conditions  under  which  the  negative  exponential 
failure  distribution  occurs  have  likewise  been  a  topic  of  considerable  inter¬ 
est,  and  of  some  disagreement.  Carhart  noted  that  field  data  show  exponen¬ 
tial  failures  to  be  prevalent  in  equipment  with  (1)  long  periods  of  opera. ion, 
(2)  relatively  constant  operating  conditions,  and  (3)  continual  replacement 
of  failing  components.  He  noted  that  vague  explanations  are  usually  offered 
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for  the  firtt  two  of  these  characteristics.  Boodman  and  Davis  take  issue 
with  Carhart's  second  conclusion,  suggesting  that  severe,  unpredictable 
stresses  characterize  the  exponential  failure  pattern.  In  any  case,  the 
exponential  distribution  of  failures  seems  to  represent  quite  well  the  be¬ 
havior  of  those  systems  which  have  no  gio»*  wearout  phenomenon  in  their 
operating  lifetimes;  and  it  seems  to  represent  equally  well  those  systems 
with  discrete  component -wearout  phenomena,  provided  the  components  of 
the  system  are  replaced  as  they  fail,  and  that  their  ages  thus  become  mixed 
after  a  time,  in  a  representative  system.  (See  Reference  6  for  a  proof.  ) 
The  most  striking  example  of  this  is  probably  the  bus -motor  case  cited  by 
Davis,  in  which  (with  ,ill  parts  new  at  the  outset)  the  elapsed  time  before 
the  first  major  overhaul  had  a  Gaussian  distribution  (i.  e. ,  with  a  distinct 
wearout  pattern),  while  the  third  and  subsequent  overhauls  (with  part  ages 
now  mixed)  occurred  exponentially. 

The  exponential  failure  phenomenon  has  a  crucial  implication  for 
maintenance  policy;  it  says  that  preventive  maintenar  -e,  in  the  normally 
accepted  sense,  is  pointless.  ^  Ac/stcm,  subsystem,  or  component 
which  has  an  exponential  failure  characteristic,  and  which  is  known  to  be 
in  operating  condition,  is  just  as  lil.cly  to  survive  for  a  given  time  period 
as.  is  a  replacement  which  may  be  new  or  newly  overhauled.  Thus,  periodic 
replacement  rtf  systems,  modules,  or  components  is  not  warranted  unless  it 
is  known  tv  ey  will  wear  out  within  the  anticipated  system  lifetime.  Periodic 
inspection  becomes  equivalent  to  periodic  renewal. 

A  second  interesting  characteristic  of  exponential  failures  is  the 
attractive  analytic  behavior.  All  the  important  quantities  can  be  repre¬ 
sented  analytically  by  linear  equations  or  exponentials;  and  exponentials 
cam  often  be  approximated  by  linear  expressions.  This  makes  the  exponen¬ 
tial  failure  pattern  an  intriguing  one  for  "paper"  studies  of  many  kinds,  the 
most  obvious  of  which  i3  optimization  in  one  form  or  another. 

Our  purpose  here  is  to  relate  checkout  frequency  to  the  operational¬ 
readiness  characteristics  of  static  alert  systems;  that  is,  those  systems 
which  are  kept  in  readiness  for  emergency  use  at  some  future  time  in  a 
role  of  retaliation,  defense,  search,  or  any  number  of  other  functions.  We 
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will  deal  primarily  with  systems  which  spend  most  of  their  operational 
lives  in  an  "off"  or  "standing"  condition,  although  only  minor  modifications 
of  the  technique  are  necessary  to  treat  those  systems  which  operate  contin¬ 
uously  (or  nearly  so).  We  will  deal  with  system*  <*r.  CApuu^utiiil 

failure  distribution.  In  order  to  demonstrate  clearly  the  method  used  and 
the  technique  for  including  various  idiosyncrasies  of  particular  operational 
site-  '.ions,  we  will  start  with  a  very  simple  model,  and  then  add  complica¬ 
ting  factors  to  it. 

3.0  THE  SIMPLEST  MODEL 

Consider  a  system  ,  weapon,  or  part  which  is  to  be  maintained  in  a 
standing  condition  (static  alert)  for  a  large  number  of  time  periods.— ^  The 
system  has  an  exponential  failure  distribution  with  a  mean  time  to  failure 
tf  and  a  corresponding  constant  failure  rate  \  -  The  system  receives 

a  checkout  every  T  time  periods,  which  imposes  a  stress  (probability  of 
failure)  q  on  a  good  system.  The  checkout  time  is  negl'^ible,  and  it  is 
aejumed  that  the  checkout  will  uncover  any  existing  failure,  whether  caused 
by  the  checkout  or  merely  by  standing.  It  takes  an  average  of  R  time  per¬ 
iods  to  correct  a  malfunction  and  the  time -deterioration  of  the  system  starts 
anew  at  t’n?  end  of  the  checkout. 

irigu.-c  1  shows  an  "out  of  commission"  piofile  (the  heavy  solid  line) 
for  the  situation  described  here.  The  ordinate  is  the  probability  of  the  sys¬ 
tem  being  out  of  commission  as  a  function  of  time.  The  system,  weapon, 
or  part  is  assumed  to  be  in  commission  at  t  =  0,  and  the  probability  of 
failure  increases  according  to  the  exponential  relationship.  A  failure  during 
this  perioi  is  initially  undiscovered;  that  is,  the  operator  is  not  yet  aware 
of  it.  A  checkout  is  performed  at  time  T.  At  this  time  any  failure  bocor.es 
known,  whether  a  previously  undiscovered  one  or  one  caused  by  th» 


2 ] 

— '  For  illustrative  purposes,  one  day  will  be  the  time  period  used  here, 

although  it  can  be  any  other  convenient  unit,  such  as  a  minute,  hour,  week, 
or  month.  The  need  for  a  large  number  of  time  periods  is  discussed  later 
in  this  section. 
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checkout  itself.  Tb  '  latter  quantity  is  the  product  of  the  checkout  failure 

probability  q  and  the  probability  of  the  system's  being  "good"  at  time  T 

(checkout  cannot  cause  a  failure  which  has  already  occurred).  Thus,  the 

-XT  -XT 

line  BC  is  of  length  q  [  1  -  (1  -  e  )  ]  ,  c”  simply  qe  If  a  failure  is 

found,  a  repair  is  made  or  a  replacement  system  is  installed  (taking  a  time 
R).  The  repaired  or  r  placed  system  is  not  checked  subsequent  to  installa¬ 
tion.  Thus,  the  original  failure  rate  (with  the  system  starting  good)  resumes 
at  point  C.  However,  line  segment  CD  does  not  have  the  same  slope  as  seg¬ 
ment  TE  (shown  dotted)  since  only  a  system  which  has  passed  the  checkout 

-XT  *■" 

(i.e.,  [1  -  q]  e”  )  must  be  considered  as  going  out  of  commission 

(unknown  to  the  operator)  at  the  rate  X  .  A  system  which  failed  the  check¬ 
out  is  in  repair  and  should  not  be  counted  out  of  commission  twice. 

At  time  T  +  R,  the  repair  or  replacement  process  is  complete  and 
a  system  is  in  commission  except  for  the  probability  (unknown  to  the  opera¬ 
tor)  of  having  failed  since  the  previous  checkout,  whether  it  was  standing  or 
n  repair,  from  this  point  the  process  is  repeated  and  is  seen  to  be  cyclic^ 
with  period  T  after  the  initial  transient  caused  by  our  assumption  of  a  good 

at  t  :  ft 

Mote  that  the  ordinate  y  in  Figure  1  accounts  tor  all  ways  of  being 
cut  or  order,  whether  or  not  the  operator  ?s  aware  of  the  condition.  Speci¬ 
fically,  it  accounts  for  a  finite  probability  of  failure  in  a  system  which  has 
not  been  checked  out  for  periods  of  time  ranging  from  0  to  T,  and  which  is 
usually  considered  in  commission  according  to  normal  Air  Force  termi¬ 
nology.  Thus,  it  "is  desirable  to  define  here  what  might  be  called  a  "real" 
in  commission  rate  or,  preferably,  "ready  rate,  "  to  distinguish  it  from  the 
other  connotation.  This  will  be  the  probability  of  a  system's  being  in  a  good 
condition,  when  one  accounts  for  the  probability  of  an  existing  but  undis¬ 
covered  failure. 


^  Note  that  the  cycle  length  is  constant,  a  desirable  arrangement  if  a 
checkout  team  is  to  go  from  system  to  system  on  a  scheduled  basis.  For 
a  similar  derivation,  when  cycle  length  depends  on  the  outcome  of  the 
checkout,  see  Reference  8. 


If  we  wish  to  find  an  analytic  expression  for  the  average  probabiii'y  of 
a  syntem's  being  in  a  good  condition,  we  can  find  the  area  under  the  out-of- 
commission  curve  for  one  cycle,  divide  by  the  ryc'e  length,  and  subtract 
from  one.  (This  average  will  fairly  well  represent  the  ready  rate  for  a 
group  of  such  systems  if  checkouts  of  the  systems  are  staggered  instead  of 
simultaneous. )  The  total  area  under  the  curve  is  most  easily  found  by 
summing  areas  1,  2,  3,  and  4  in  Figure  1: 

A  «  Area  1  +  Area  2  +  Area  3  +  Area  4  (1) 


Substituting  the  area  equivalents,  v/e  have 


A  «  f  (1  -  e_>t*  dt  +  (1  -  q)  e'XT  fR  (1  -  c~>wt)  dt  +  (1  -  e"XT)  R  +  qRo41 
R  J0  (2) 


Integrating,  cancelling  like  terms  of  opposite  sign,  dividing  by  the 
cycle  length  T,  and  subtracting  from  one,  we  find  the  proportion  of  time  in 
commission  (the  ready  rate)  is:  ^ 

■XR  fl  rf.-MT+R)  „.-XT 

..  r\l  :  _  ..—1e _ ,  *. 


A 

T 


-XR  .XT  ... 

is _ 

Tr 


XTc 


We  car.  :ail  this  expression  G( X,  q,  R,  T)  or  simply  G(T),  since  X,  q,  and 
R  are  gen -rally  the  input  constants.  It  shows  not  only  the  average  prob¬ 
ability  of  a  jiven  system's  being  in  commission,  but  also  what  fraction  of  a 
large  number  of  such  systems  are  in  a  good  condition  aa  a  function  of  the 
quantities  X,  q,  R  and  T. 


A  simpler  expression  for  the  ready  rate  can  bs  derived  in  the  same 
manner,  by  first  making  the  linear  approximation  to  the  exponential 
(ex  wlix)  and  then  proceeding  ae  before.  The  process  it  shown  in  Figure  2. 
If  the  resulting  equation  is  rolved  for  the  value  of  T  which  minimises  out -of - 
commission  time  (and  thus  maximises  ready  rats)  the-  result  i«  T 


It  may  occur  to  tha  render  that  Equation  (3)  can  also  bs  solved  for  a 
maximum  if  the  exponentials  ere  approximated  linearly.  Unfortunately,  this 
gives  a  result  which  is  not  at  all  accurate,  as  Figure  3  clearly  shows.  The 
result  is  T  *  v  +  i  ,  where  v  «  fta-  The  singularity  at  XR  =  1 
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FIGURE  2.  APPROXIMATE  PROFILE 


CHECKOUT  INTERVAL  FOR  MAXIMUM  READY  RATE  AS  A  FUNCTION  OF  FAILURE  RATE 

<  LOGARITHMIC  SCALE) 


constitutes  an  additional  objection.  The  appioxima'e  equation  "ncntioned 
earlie/  gives  by  far  the  best  solution  for  the  maximum. 

4.  0  MODELS  BY  OTHER  INVESTIGATORS 


Similar  analytical  expressions  have  been  developed  elsewhere,  one  of 
the  earlier  and  more  prophetic^  ones  beir  reported  by  Thompson.  ^  He 
developed  an  equation  for  readiness  using,  for  the  most  part,  the  same 
assumptions  made  here,  with  an  important  exception  being  that  the  checkout 
interval  depends  on  the  outcome  of  the  immediately  prior  checkout.  If  the 
checkout  shows  a  "go,"  or  a  good  system,  the  interval  is  T;  if  'no-go,"  or  a 
bad  system,  the  'nterval  to  the  next  checkout  is  T  +  R.  Under  these  condi¬ 
tion*  he  showed  that  the  ready  rate  is,  in  the  symbols  of  this  example: 


G(T)  = 


1  -  e 


-XT 


XT  +  XR  [1  -  (1  -  q)  e‘VT] 


Thompson's  paper  also  reports  an  equation  developed  at  his  request  by 
Alan  S.  Manne,  who  had  used  the  assumption  of  a  constant  interval  regard¬ 
less  of  the  outcome  of  t.,e  checkout.  In  addition,  Manne  had  uaed  a  linear 
approximate  a  for  the  exponential,  which  he  noted  was  inaccurate  when  the 
prod  ict  XT  exceeded  approximately  0.  2b.  His  equation  was  identical  to  the 
one  shown  x r  Figure  2,  although  he  used  a  different  method  to  derive  it. 

Figure  4  shows  a  comparison  of  the  ready  rates  predicted  by  the  three 
equations  when  the  failure  rate  X  is  0.  10,  the  checkout  stress  q>  0.  10, 

R  -  1  day,  and  T  varies  from  1.  0  to  100.  It  is  evident  that  Maude's  caution 
about  ‘he  site  of  the  product  XT  was  very  necessary.  The  other  significant 
point  to  be  observed  in  Figure  4  is  that  Thompson's  equation  gives  a  con¬ 
sistently  higher  readiness  than  do  the  equations  developed  here,  for  identical 
values  of  X,  q,  and  R.  It  does  so  because  it  does  not  account  for  "aging"  or 


— ^The  basic  assumptions  of  the  Thompson  Model  were  incorporated  into  an 
extensive  "hierarchy"  of  readiness  models  developed  subsequently  at 
Space  Technology  Laboratories. 
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failure*  due  to  standing  stress  during  the  repair  of  a  system  which  failed 
the  checkout.  His  derivation  assumed  that  any  repaired  system  was  known 
to  be  good  at  the  completion  of  a  repair.  This  may  be  true  if  the  entire 
system  is  replaced  as  a  unit  and  is  known  to  have  no  standing  failure  rate 
until  installed.  Generally,  hov/ever,  it  may  not  be  a  realistic  assumption, 
particularly  when  a  repair  consist*  of  the  replacement  of  only  part  of  a 
system.  Those  parts  of  the  system  which  were  not  defective  when  checked 
will  continue  to  be  subject  to  time -dependent  failures  during  the  time  that  a 
malfunctioned  part  is  being  replaced.  (The  case  in  which  a  system  is 
verified  by  a  checkout  at  the  conclusion  of  a  repair  will  be  treated  later. ) 

Figure  5  shows  the  readiness  predicted  by  the  same  three  equations 
when  the  repair  time  R  is  greatly  exaggerated.  As  expected,  the  Thompson 
equation  predicts  a  much  higher  ready  rate  than  do  the  other  two  equations, 
because  it  neglects  standing  failures  during  the  long  repair  periods.  The 
differences  are  particularly  large  for  very  frequent  checkouts.  However, 
for  the  values  of  repair  time  normally  encountered  in  practice,  the  differ¬ 
ences  between  the  Thompson  equation  and  the  one  derived  here  are  small. 

In  view  of  the  discrepancies  between  the  Thompson  equation  and  the 
approximate  equation,  one.  may  reasonably  inquire  why  Thompson  was 
interested  enough  in  Manne's  result  to  include  it  in  his  own  discussion.  The 
answer  can  be  seen  in  both  Figures  4  and  5,  but  it  is  not  readily  apparent. 
The  highest  point  of  both  curves  (and  in  fact  of  all  three  curves)  occurs  at 
approximately  the  same  value  of  T.  In  addition,  the  approximate  equation 
alone  among  the  three  can  be  solved  explicitly  for  the  point  where  its  deriv¬ 
ative  vanishes,  with  the  simple  result  that  T  <  and  one  of  Thompson's 

objectives  was  to  find  a  simple  expression  for  this  value  of  the  checkout 
interval. 

Aside  from  the  inaccuracy  of  the  approximation  used  (which  is  usually 
minor),  this  apparently  interesting  checkout  interval  was  derived  without 
consideration  of  possible  restrictions  on  support  capabilities  (checkout  and 
repair)  and  costs.  It  gives  a  useful  result  only  if  the  maximum  number  of 
systems  must  be  kept  ready,  regardless  of  all  other  considerations.  One 
such  situation  applies  when  the  value  of  alert  time  on  a  weapon  system 
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READY  RATE  AS  A  FUNCTION  OF  CHECKOUT  INTERVAL 
(LOGARITHMIC  SCALE) 


overwhelms  all  other  considerations,  as  it  does  during  a  temporary  world 
crisis  (such  as  the  Cuban  crisis  in  1962).  The gives  the  checkout- 
interval  goal  for  the  support  activity  beyond  which  they  should  not  try  to  go. 
Another  appropriate  situation  would  be  vhen  co3ts  were  relatively  unaf¬ 
fected  by  checkout  interval,  as  when  both  checkout  and  repair  facilities  are 
available  without  practical  limit  or  added  cost. 

Before  we  leave  this  model,  let  us  observe  one  of  the  less  apparent 
limitations  on  its  accuracy  and  use.  It  can  be  shown  mathematically  that 
models  of  this  type,  for  determining  average  readiness,  are  exact  only  for 
an  infinite  time  horizon.  If  the  system  is  operational  for  a  matter  of  years, 
however,  and  repair  times  are  on  the  order  of  days,  the  error  resulting 
from  use  of  the  equations  presented  is  entirely  negligible. 

Having  developed  a  model  which  may  be  too  simple  to  fit  many  real- 
world  cases,  we  can  use  the  same  technique  to  derive  more  realistic  or 
accurate  models  of  plausible  situations. 


5.  0  CHECKOUT  AS  DOWNTIME 

If  we  must  regard  the  checkout  process  as  rendering  the  system 
urasable  until  it  is  complete,  we  can  make  a  iris  lively  simple  modification 
to  the  time  profile  to  account  for  the  fact.  Figuie  6  shows  such  a  profile, 
with  the  system  out  of  action  during  the  checkout  period  of  length  s.  The 
area  summation  is  now:  A  =  Area  1  +  Area  2  +  Area  3  +  Area  4  I  Area  5, 


A  =  f  T  S(1  -  e'Xt)  dt  *  (1  -  q)e'XT  f  R(  1  -  e'Xt)  dt  +  (l  -  e  iT)  R  +  qRe^t 
R  °  (4) 


Proceeding  as  before,  we  find  that 

>»<T-R>+(1  - 


CKT) 


XT  e 


-  e"^)  -  eX" 


-  R) 


-  (1 


,  -XR 
-  q)  e 

XT - 

XT  e 


-  1-t  <*  -■ 


Xs. 

e  ) 


■XR  .  XT 
(e 


i>  .-_al_L 


Xs 


XT  e 


(5) 

The  latter  form  shows  that  the  only  difference  between  this  and  the  previous 
result  is  that  (1  -  eXs)  has  appeared  in  the  numerator.  Since  the  series 
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FIGURE  6.  OUT -OF -COMMISSION  PROFILE;  SYSTEM  OUT  OF  ACTION  DURING  CHECKOUT 


Xs  X2S2 

expansion  of  ( 1  -  e  )  lias  all  negative  terms  (  -  Xs - j .  .  .  ),  it  can 

be  seen  that,  as  expected,  the  ready  rate  with  checkout  counted  as  downtime 

s  lower  than  before  for  the  same  values  of  X,  R,  q,  and  T.  If  the  series 

approximation  is  made  once  again  for  the  exponential  (introducing  the 

approximation  before  summing  the  areas,  differentiating,  etc.  ,  as  in  the 

derivation  of  Equation  (6)  and  as  shown  by  Figure  7),  th»  result  is 


_  y  2(qR  +  s) 


The  checkout  interval  for  the  maximum  ready  rate  is  appreciably  higher 
when  checkout  time  must  be  considered  as  non-alert  time. 

A  -  Area  1  +  Area  2'  +  Area  3  +  Area  4  +  Area  f> 


=  jr  X  (T  -  S)2  +  ( 1  -  XT)  qR  +  X(T  -  S)R  +  S 
=  j-  XT2  -  XST  +  t  XS2  +  qR  -  XqRT  +  XRT  XSR  +  S 
Xs  +  -  XqR  +  XR  -  ^  | 


_  A  XT 
v  *  T  =  T 


?■ 


0  = 


XS 


-*2- 

2T“  T*  T 


XSR 


T  a  y'2(qR  4  S)  -  XS  (?.R  -  S)  ^  J  2(qR~+  S) 


(b) 


6.0  IMPERFECT  CHECKOUT;  IMPERFECT  REPAIR 

We  have  been  assuming  that  the  checkout  process  was  perfect;  that 

is,  if  a  defect  or  failure  existed  before  a  checkout  or  was  caused  by  a  par - 

5/ 

ticular  checkout,  it  would  always  be  discovered  during  th<*t  checkout.—  Ve 
will  now  account  for  imperfections  in  checkout. 


5  / 

—  Although  it  was  not  staled  explicitly,  it  should  be  fairly  evident  that  the 
accuracy  assumption  also  meant  that  good  systems  would  indicated  as 
such. 
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FIGURE  7.  OUT-OF-COMMISSION  PROFILE  -  APPROXIMATION 
(CHECKOUT  AS  DOWNTIME) 

Two  separate  and  distinct  types  of  inaccuracy  are  possible.  A  check¬ 
out  may  call  a  good  system  bad  01  a  bad  system  good.  Occasions  when  r. 
good  system  is  called  bad  may  be  interpreted  quite  simply  as  cases  of 
failure  "caused"  by  the  checkout,  since  such  failures  will  ordinarily  impel 
repair  actions.  In  other  words,  such  an  inaccuracy  t sometimes  called  a 
Type  I  error)  can  be  accounted  for  by  including  in  the  parameter  q  an 
allowance  for  this  type  of  error  by  substituting  q1  =  q  +  qj  tar  it,  where  q^ 
is  the  probability  of  calling  a  good  system  bad. 

Calling  a  bad  system  good  is  sometimes  referred  to  as  a  Type  II 
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error.  If  such  an  error  is  random  (that  io,  the  probability  of  its  being 
repeated  is  the  same  as  the  probability  of  its  being  made  in  the  first  place) 
and  is  equal  to  q2>  it  can  be  shown  that  the  ready  rate  is  — ^ 


G  =  (1 


-  «2l 


■  XR  .  XT  i  j  ti  i 
e  ( e  -  1  i  q)  -  q 

XT  [eXT  -  q2(l  -  ctf)] 


(7) 


The  checkout  interval  for  maximum  readiness  can  once  again  be  found  by- 
making  the  linear  approximation  for  the  exponential  and  proceeding  with  the 
area  Summation.  •'■•“••afjing,  differentiation  etc.  .  The  result  is: 


T  =  ' - -  (8) 

^  x  [1  +  2q2  (1  -  q')J 

indicating  that  this  time  is  shorter  than  it  was  for  the  simple  method. 

One  other  worthwhile  observation  can  be  made  before  we  leave  this 

topic.  Consider  the  problem  of  accounting  for  defective  repair  actions.  In 

effect,  such  occurrences  are  identical  to  railing  bad  systems  good;  in 

either  case,  a  given  fraction  of  the  failed  systems  are  not  replaced.  If  we 

denote  the  probability  of  a  bad  repair  as  b,  then  simple  substitution  of  b 

7  / 

for  in  equation  (7)  will  give  the  ready  rate  for  this  case. — 

7.  C  C  iifcCKOUT  AFTER  REPAIR 

We  have  been  assuming  that  checkouts  do  not  follow  repair  or  replace¬ 
ment.  In  actuality,  the  reverse  is  more  likely  to  be  true,  so  we  shall 
examine  the  case  in  which  a  successful  checkout  is  required  before  a  repair 


—  If  the  same  error  is  repeated  consistently,  the  ready  rate  goes  to  zerc  and 
the  choice  of  the  checkout  interval  is  inconsequential.  Such  checkouts  are 
obviously  useless. 

•— ^The  derivation  of  this  result  is  fairly  typical  of  the  complications 
encountered  in  probabilistic  modifications  to  the  simple  model. 
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8  / 

is  considered  complete.  — 


Figure  8  shows  a  portion  of  an  out-of-commission  profile  under  a 
"check  after  repair"  policy,  with  the  dashed  line  showing  the  "no  check" 

i 

situation.  When  the  repair  period  ends,  the  protile  drops  only  to  point  A 

instead  of  A,  since  a  probability  remains  that  the  repaired  system  will  fail 

the  subsequent  checkout  due  to  the  probability  of  a  bad  repair  (b),  the  check- 

-  X.R 

out  stress  (q),  or  the  stress  of  standing  for  R  time  periods  (1  -  e  ).  The 
second  and  third  steps  are  progressively  smaller;  by  the  time  the  series  dies 
out,  the  solid  line  may  be  below  the  dashed  one.  (The  system  being  checked 
after  repair  has  a  shorter  mean  lime  since  its  last  checkout  and  is  thus  less 
likely  to  have  failed  because  of  standing. )  It  is  an  extremely  complicated 
process  to  derive  an  exact  analytical  expression  for  the  area  under  the  solid 
curve,  because  each  "step"  gives  rice  to  a  system  of  a  different  age  when  the 
the  next  checkout  is  due.  In  order  to  keep  the  fixed  checkout  schedule  we  can 
use  the  principle  of  superposition,  separating  the  effects  of  (1)  age  stress 
and  regularly  scheduled  checkout,  and  (2)  checkout  stress  and  repair 
deficiencies,  inu  is  an  exact  solution  only  when  linear  functions  are  in¬ 
volved,  but  the  exponential  is  so  nearly  linear  in  the  interesting  range  of 
par  finest:  s  that  the  resulting  error  is  ordinarily  insignificant.  Figure  9 
shows  the  process  in  graphical  form.  The  area  due  to  age  and  regular 
chteko"*  ;s  the  same  as  in  the  first  derivation  (from  Figure  1).  The  area 
due  to  checkouts  after  repairs  is: 

R  ( 9y  +  02y  +  63y  t  .  .  - ), 

where  y  is  Ihe  probability  of  a  system's  failing  the  regiilarly  scheduled 

-  kT 

checkoutr*l  -  (1  -  q)e  ,  and  9  is  the  probability  of  its  failing  the  post¬ 
repair  checkout  due  to  faulty  repair  or  stresses  imposed  during  repair  and 


8  / 

-  If  only  a  partial  checkout  follows  the  repair,  to  check  that  single  function 
which  was  previously  faulty,  then  the  effect  might  be  small  enough  to 
ignore.  Another  alternative  might  be  to  increase  the  repair  time,  R,  to 
allow  for  checkouts  and  possible  additional  repair  activity  after  the 
original  repair  In  general,  sufficient  objections  can  be  raised  to  both  of 
those  approximations  to  make  a  more  detailed  analysis  desirable. 


t 
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FIGURE  9 


SUPERPOSITION  OF  NORMAL  AND  POST -REPAIR  PROFILES 


-  XR 

subsequent  checkou*.  (It  should  be  evident  that  0  =  b  +  q  +  1  -  e  .) 
Since  the  series  is  a  binomial,  the  area  involved  can  be  expressed  as: 

"['-“r-V*7 1 

Combining  areas,  dividing  by  cycle  length,  and  subtracting  from  one,  the 
ready  rate  can  be  found  to  be: 


G(T)  = 


.  XT  .  .  ,  -XR  XRO  . 

(e  -  1  +  n)  (e  -  y^tq)  -  q 


XT  e 


XT 


(9) 


Once  again,  the  approximate  checkout  interval  for  maximum  readiness  can 
be  found  by  making  the  linear  approximation  to  the  exponential,  the  result 
being: 

*  ■  i '  <>°» 


Again,  the  checkout  interval  which  gives  ‘.ho  maximum  readiness  is 
lengthened  from  what  it  was  in  the  original  simple  model.  It  should  be 
clear  at  this  point  that  modifications  designed  to  improve  the  validity  of 
the  simple  model  may  increase  or  decrease  the  interval  at  which  the 
maximum  ready  rate  cct  irs. 


lince  we  now  have  expressions  which  show  the  ready  rate  with  and 
without  checkout  after  repaii ,  we  «_•»»  uee  them  ts  compare  the  two  policies 
and  find  which  one  gives  a  higher  ready  rate.  A  comparison  in  parametric 
form  of  Equations  ( 7)  and  (9|  gives  no.siittf^^  result,  so  that  an  svaluation 
of  G  for  both  cases  must  be  * 

It  sbpuld  be  s videslb .that  pscalfo f  Apetticular  app. iebtion 

can  be  incorporated  into  »  model  telatfe^J^iyMMlkp##  tb  bthcr  parameters, 
and' particular  lyto the  checltoa*  fartarvdL  rat  tails'  Ahftuased  here,  the' 
final  approximate  result  for  the  chsck^'Sataeybi  which  -maxiraises  read! 


In  general,  the  effects  of  the  complicating  factors  studied  here  are 
small  compared  with  the  effects  of  the  parameters  X,  q,  and  R. 

8.  0  THE  EFFECT  OF  MAINTENANCE  RESOURCES 

Another  source  of  weapon  system  unavailability  arises  when  a  failed 
system  must  wait  for  maintenance  resources  (men  and  equipment)  because 
they  are  engaged  in  repairing  another  system.  Since  demands  to  such 
resources  are  typically  distributed  randomly  along  a  time  scale,  closely- 
spaced  demands  (i.  e.,  failures  requiring  service)  will  occasionally  outstrip 
the  repair  capability  unless  support  is  provided  at  an  unrealistically  (and 
uneconomic  ally)  high  level.  The  amount  of  unavailability  which  resultc  from 
this  source  can  in  many  rases  be  legitimately  and  accurately  treated  by  the 
branch  of  mathematical  science  called  queuing  theory,  or  waiting-line 
theory. 

“  The  basic  information  requirements  are  estimates  or  factual  data 
concerning  the  frequency  of  demands  for  a  particular  resource  and  the 
average  length  of  time  that  resource  will  be  occupied  in  fulfilling  the  de¬ 
mands.  (If  economics  enters  the  evaluation  then  the  costs  of  providing 
resource  ir -reorients  and  the  value  of  the  resulting  incremental  operational 
capability  must  also  be  known. )  As  an  example,  the  Minuteman  weapon 
system  specifications  provide  such  workload  factors.  ^  ^  ^  Failure  rates 

for  systems  and  subsystems  are  estimated,  in  terms  of  failures  per  month 
for  a  150  missile  wing.  "Time  lines"  indicate  how  lcng  each  type  of  re¬ 
source  will  be  tied  up  in  performing  each  task,  including  trav  times  to 
site,  etc..  The  product  of  these  two  pieces  of  information,  for  a  given 
equipment  item  or  a  particular  maintenance  team,  will  yield  the  expected 

If  one  is  concerned  only  with  resource  utilization,  the  necessary 
quantity' can  be  determined  easily  and  directly.  Suppose,  for  instance, 
that  a  particular  major  component  has  an  estimated  failure  rate  of  50  per 
month  for  a  150  missile  wing,  and  that  each  failure  can  be  expected  to  tie  up 
a  certain  piece  of  equipment  and  associated  team  for  50  hours.  Expected 
utilization  is  then  50  x  50  or  2500  hours  per  month.  Assume  25C  hours  per 


month  permissible  utilization  ot  the  equipment  (perhaps  0  hours  per  day,  31 
days  a  month),  and  it  is  seen  that  10  sets  of  in-commission  equipment  are 
required  with  this  method  of  calculation.  Assume  140  hours  per  month  per 
team,  to  allow  for  leave,  illness,  squadron  d  'ties,  etc.,  and  18  teams  of 
maintenance  personnel  need  to  be  assigned.  Utilization  of  teams  and  equip-’ 
ment  alike  would  be  nearly  100  per  cent,  a  very  "efficient"  operation.  A 
substantial  part  of  the  force  would  be  kept  waiting  its  turn  in  line,  however, 
unless  each  new  failure  occurred  just  as  the  previous  one  had  been  corrected 
--  and  we  know  that  .his  does  not  happen.  There  are  those  days  when  all 
goes  well,  and  those  when  everything  goes  wrong. 

Large  bodies  of  data  indicate  that  complex  weapon  systems  usually 

experience  malfunctions  distributed  in  a  "random"  fashion.  For  a  specific 

example,  let  us  assume  data  has  shown  or  engineering  estimates  indicated 

that  3  per  cent  of  the  150  missile  wings  will  malfunction  on  an  average  day; 

thus  there  will  be  an  expected  135  failures  per  30-day  month.  For  the 

moment  also  assume  there  is  one  particular  typ*  of  equipment  and  mainte-  , 

nance  team  which  handles  these  failures,  and  that  each  failure  takes  exactly^ 

2  days  to  repair.  Using  a  table  of  random  numbers'  '  and  applying  the 

1 -pe- -cent  failure  probability,  the  following  failures  occured  in  the  simu- 

Q  / 

lacion  of  a  30-dav  month.— 


9  / 

—  With  a  3-per-cent  failure  probability  for  each  of  150  missiles,  the  e-'pecte 
number  of  tailures  per  day  is  simply  3  per  cent  of  150  or  4.  5.  With  this 
rate,  the  probability  of  having  a  particular  number  ci  failures  on  any 
given  day  is,  from  a  table  of  Poisson's  Exponential  Binomial  Limit:04) 


No. 

Proba¬ 

bility 

No. 

irfPTB 

Mi 

0 

0.011 

5 

0.  171 

10 

1 

0.050 

6 

0.  128 

11 

BjMjWl 

2 

0.  112 

7 

0.  082 

12 

■win 

3 

0.  169 

8 

0.  046 

13 

0.  001 

4 

0.  190 

9 

0.  023 

14 

0.  000 

We  now  draw  three-digit  random  numbers.  If  the  number  drawn  is  from 
1  to  11,  there  are  no  failures  that  day;  it  from  12  to  61,  one  failure;  if 
from  62  to  173,  two  failures,  etc. . 
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in 

No.  of 
Failure  h 

Day 

No.  of 
Failures 

i 

8 

16 

2 

2 

1  1 

17 

4 

3 

4 

18 

1 

4 

6 

19 

* 

5 

5 

20 

3 

6 

3 

21 

0 

7 

3 

22 

i 

8 

4 

23 

5 

1  U 

1 

24 

7 

10 

3 

25 

4 

11 

0 

26 

4 

12 

1 

27 

5 

13 

4 

28 

3 

14 

3 

29 

4 

15 

1 

30 

<  . 

This  month  has  only  110  failures,  instead  of  the  expected  115.  In  sum* 
months  there  will  be  substantially  more  failures  than  the  average  expected 
Figure  10  shows  this  months  distribution.  There  were  7  '*»«»«  with  n.->  f»i 
9  d_ys  with  4  failures,  1  day  with  11,  et*-.  .  '’’he  "expected"  distribution  is 

also  shown.  Despite  the  lower -than -usual  mo  ithly  workload,  we' can  expect 
some  workload  control  problems,  esnerialiy  since  the  Iwu  heaviest  days  fall 
one  af* er  the  other,  on  the  1st  and  2nd  of  the  month.  Figur  11  indicates  the 
woriinin  i  lit!  niLiiii..  that  each  job  is  discovered  and  started  at 

the  beginning  c  f  one  day,  and  is  complct?*  it  nf  *■>»«*  •»rnnH  dav.  A 

carryover  of  4  jobs  from  last  month  (assumed,  based  on  lat- .  day  this  month) 
plus  8  more  on  day  1,  occupies  12  teams;  the  carryover  i  f  8,  plus  11  on  day 
2,  results  in  the  peak  load  of  19  teams.  No  new  wor!  jn  day  1 1  and  only  1 
job  on  day  12,  results  in  almost  no  work  by  contrast. 

To  perform  this  month's  work  without  any  delays  whatever  will  ’•equ-re 
19  teams  on  duty,  although  team  utilisation  would  only  be  at  t  39  per  cent. 
Suppose  we  had  only  18  teams;  the  unit  of  work  numbered  (1)  would  have  to  be 
delayed  from  day  2  to  day  3.  With  only  14  teams,  units  of  work  numbered 
(1)  through  (6)  would  have  to  be  delayed  for  the  periods  indicated  There 
would  be  a  total  of  13  alert  missile  days  lost.  Table  I  indicates  tne  story  as 
teams  are  cut  progressively  to  9,  where  172  alert  missile  days  are  lost 
waiting  for  teams  (nearly  6  missiles  on  the  average  each  day),  and  yet  lam 
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reqieccy  of  occurrence 
Day  per  month 


FIGURE  10 

DISTRIBUTION  OF  FAILURES  FOR  A  SIMULATED  MONTH 
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WORKLOAD  DISTRIBUTION  FOR  A  SIMULATED  MONT  i 


utilization  is  only  8 2  per  cent. 

V 

*  TABLE  I 

MISSILE  WORK  DELAYS  AS  A  FUNCTION  OF  NUMBER 
OF  TEAMS  FOR  A  SIMULATED  MONTH 


No.  of 
Teams 

Percent 

Utiliza¬ 

tion 

Alert  Missile- 
Days  Lost  Wait¬ 
ing  for  Teams 

19 

39 

0 

18 

41 

1 

17 

43 

2 

16 

46 

5 

15 

49 

8 

14 

52 

13 

13 

57 

22 

12 

61 

35 

11 

67 

62 

10 

73 

105 

9 

82 

172 

We  have  already  indicated  that  this  month's  experience  was  "unusual,  " 
both  in  having  fewer  failures  than  exported  and  in  the  failure  distribution. 

We  will  .inter  the  table  of  random  numbers  again,  therefore,  to  establish  a 
second  month'*  experience.  Figure  12  chrvc  i1**  Ftanre  13 

the  workload.  This  time  there  were  131  failures  (vs.  the  135  expectod). 
T*bl“  li  presents  the  story  as  the  number  of  teams  are  reduced,  as  did 
Table  i  tor  the  first  month. 


TABLE  II 

MISSILE  WORK  DELAYS  AS  A  FUNCTION  CF  NUMBER 
OF  TEAMS  FOR  ANOTHER  SIMULATED  MONTH 


No.  of 
Teams 

Percent 

Utiliza¬ 

tion 

Alert  Missile  - 
Days  Lost  Wait¬ 
ing  for  Teams 

14 

62 

0 

13 

68 

1 

12 

73 

7 

11 

80 

18 

10 

88 

42 

9 

97 

132 
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Frequence  of  occurrence 
DaV»  per  month 
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WORKLOAD  DISTRIBUTION  FOR  A  SECOND  MONTH 


Again  the  incompatibility  of  high  utilization  of  maintenance  resources 
and  a  high  degree  of  operational  readiness  is  evident.  At  the  extremes  of 
the  two  tables,  we  choose  between  team  utilization  of  only  40  to  40  per  cent 
and  maximum  possible  force  readiness,  or  team  uulization  of  80  to  95  per 
cent  with  an  average  five  or  so  missiles  waiting  for  maintenance  a*  all  times. 

In  1958,  Peck  and  Hazelwood  produced  a  set  of  finite  queuing  tables 
(Reference  15)  in  which  they  stated: 

This  monograph  is  intended  to  provide  useful 
tables  for  the  solution  of  a  variety  of  queuing  problems. 

There  are  several  textbooks  and  monographs  which 
discuss  the  theoretical  aspects  of  queuing  theory,  and 
the  literature  contains  an  impressive  number  of  re  - 
'  search  papers  dealing  with  such  problems.  However, 
there  is  *  paucity  directions  for  useful  applications 
of  these  ideas.  A  person  exposed  to  the  concepts  of 
queues  is  able  to  recognize  broad  areas  where  the 
theory  could  be  applied,  but  he  is  often  at  a  loss  to 
find  ways  of  solving  the  problems.  . 

In  general,  queuing  theory  deals  with  the  for-  — ; 

mation  of  a  queue,  or  waiting  line.  Suppose  there 
is  some  service  point,  such  as  . . .  a  repairman 
servicing  a  broken  machine,  etc.  Part  of  the  time 
this  service  point  will  be  busy  providing  service, 
part  of  the  time  it  will  be  idle.  If  the  service  point 
or  "channel"  is  busy  and  another  customer  arrives, 
he  must  wait.  This  forms  a  queue. 

This  situation  fits  cur  missile  force  where  missiles  or  aerospace 
ground  equipment  and  facilities,  requiring  maintenance,  are  the  "customcrr," 
and  maintenance  teams  are  the  service  point.  Using  our  hypothetical 
example  presented  earlier,  let  us  enter  the  Peck  and  Hazelwood  tables  and 
examing  the  findings.  A  typical  portion  looks  like  the  following: 

POPULATION,  N  =  150 


X 

M 

D 

F 

.  025 

7 

.096 

.999 

6 

.215 

.998 

5 

.438 

.992 

4 

.  785 

.966 

.026 

7 

.  113 

.999 

6 

.247 

.997 

5  „ 

.487 

.990 

4 

.838 

.955 

.  028 

7 

.  154 

.999 
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The  population  represencs  the  numoer  of  customers  which  can  demand 

T 

service  --  in  tnc  Minuteman  case  ISO  missiles.  X  =  service  factor  =  -p  + 
where  T  =  average  service  lime  or  repair  time,  and  U  =  average  time  not 
calling  for  service  — ^  --  in  our  case  the  mean  time  between  failures. 

M  =  service  channels  or  numbe'  of  repair  ic<.uu.  D  =  probability  that  if  a 
unit  calls  for  service  it  will  have  to  wait  ("delay"  probability).  F  =  efficiency 
factor  =  7,  ^  t  f  t  where  H  =  average  number  of  units  being  serviced,  J  = 

H  t  J  T  L 

average  number  of  units  running  (on  alert),  and  L,  •-  average  number  of  units 
waiting  for  service. 


Assumptions  in  our  specific  example  were  that  3  per  cent  of  the 
wing  would  malfunction  each  day,  on  the  overage,  and  take  ?  days  to  repair. 
Thus,  T  =  2,'U  =  33.  3  days,  and  X  -  2  +  33 "3~  =  •  The  tables  have 
X  =  .  056  and  X  =  .  058.  Rather  than  interpolate,  the  section  lor  population 
150,  X=  .058,  is  reproduced  below. 


M 

D 

F 

14 

.060 

.999 

12 

.  198 

.997 

11 

.  vtn 

,  993 

10 

.518 

.985 

9 

.  747 

.962 

8 

.939 

.905 

J.,  the  aveiage  number  of  units  waiting  for  service,  can  be  represented  as 
L,  -  N{!  -  F).  Thus  with  9  teams,  for  instance,  L  -  150(1  -  .962)  =  5.  7 
missiles.  This  is  5.  7  x  30  -  171  missile  days  per  month. 


Table  III  compares  the  queued  missiles  vs.  teams  for  the  random 
month  of  Tables  I  and  II  respectively  and  per  Peck  and  Hazelwood.  Notice 
that  P  it  H  values  are  compatible  with  those  of  the  two  ran'  >m  months.  We 
re-emphasize  here  that  one  random  month  is  wholly  inadequate  to  properly 
determine  the  distribution  of  demands,  these  examples  being  given  only  to 
illustrate  the  principles. 

We  hope  that  two  major  points  are  clearer  now:  (1)  high  utilization 
of  resources  in  the  correction  of  critical  malfunctions  (those  preventing 
launch  of  the  missile)  is  incompatible  with  high  mission  readiness,  and-thera- 
fore  uneconomical;  (2)  it  should  be  possible  to  develop  a  technique  that  can  use 


— ^  Note  that  for  the  elementary  problem  involving  only  two  states  (either 
"GOOD"  or  "TN  RFPATR"),  service  factor  is  simply  1  -  availability. 
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TABLE  III 


MISSILE  WORK  DELAYS  VS.  NUMBER  OF  TEAMS 
Peck  and  Hazelwood;  Tables  I  L  II 


No.  of 
Teams 

Missile  Days 

Queued 

Table 

I 

Table 

11 

P  &  H 

14 

13 

0 

4.  5 

rz 

7 

13.5 

n 

62 

18 

31.  b 

10 

105 

42 

67.  5 

9 

172 

132 

171.  0 

cost-effectiveness  criteria  to  measure  the  interaction  between  number  of 
teams  available  and  number  of  missiles  or  related  equipment  waiting  for 
service. 

9.  0  THE  ESTIMATION  OF  PARAMETERS 

RAND/AFLC/SAC  Study:  In  December  1962,  the  Logistics  Depart¬ 
ment  of  the  RAND  Corporation  undertook  a  project,  in  collaboration  with 
He  U4ua  ttrs  AJt  LC,  to  implement  the  results  and  methodology  of  RM-2578, 
"Determining  Checkout  Intervals  for  Systems  Subject  to  Random  Failures.  " 
The  a  y -■  ♦  m  chosen  for  the  initial  application  was  the  Atlas  "D"  weapon 
system,  which  was  fell  to  have  been  operational  long  enough  to  generate 
some  reliability  and  time -line  experience-,  both  of  which  were  essential 
inputs  to  any  implementation  action.  Duting  early  February  1963,  assis¬ 
tance  was  requested  by'  the  Directorate  of  Requirements,  Headquarters 
SAC,  "to  determine  optimum  time  intervals  between  operational  exercises 
for  Strategic  Air  Command  Intercontinental  Ballistic  Missiles.  "  — '  At 

this  point,  it  was  decided  to  combine  the  two  efforts,  concentrating  pri¬ 
marily  on  the  Atlas  "D". 


—  Reference  unclassified  letter  from  Col.  R.  E.  Barton,  Directorate  of 
Operations,  Hq.  SAC  to  The  RAND  Corp. ,  dated  5  Feb.  1963";  subject: 
Determination  of  Optimum  Intervals  between  ICBM  Weapon  Systems 
Operational  Exercises. 
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First,  the  objectives  of  the  study  program  will  be  discussed, 
followed  bv  discussion  of  a  m  a0  «imnlniinn  that  generates  the  reouired 
information  to  plan  a  test  program,  arid  also  demonstrates  how  the  second¬ 
ary  objectives  can  be  achieved. 

Objectives :  The  objective  of  the  AFLC  portion  of  the  study  was 
broadly  comprehensive,  but  can  be  simply  stated:  to  develop  a  methodnlopy 
for  setting  maintenance  activity  intervals  on  normally  inert  systems.  The 
SAC  objectives  “ere  evnliritly  stated  in  their  request  for  assistance.  The 
primary  objective  was  to  determine  optimum  time  intervals  between  opera¬ 
tional  exercises  for  SAC  ICBM's  --  "optimum"  meaning  the  interval  that 
would  yield  the  most  ready  weapons.  The  secondary  objective  was  to  be 
able  to  estimate  the  lift-off  capability  of  the  ICBM  force  at  any  arbitrary 
point  in  time,  that  is,  how  many  will  be  launched.  A  third  objective  was  to 
derive  the  confidence  level  associated  with  the  estimate  of  the  lift-off 
capability. 

12/ 

Assumptions —  :  Certain  assumptions  are  applicable  to  this  study 
effort,  as  follows: 

(1)  System  failures,  when  not  in  checkout,  are  Poisson 
distributed. 

ic.)  The  probability  of  system  failure  in  checkout  may 
be  represented  by  a  constant. 

(3)  The  probability  that  a  failed  system  will  be  assigned 
to  alert  statue  is  zero. 

(4)  Type  I  and  Type  11  statistical  errors  are  negligible. 

Data  Requirements:  In  order  to  estimate  q  and  ^  for  the  related 
mathematical  models,  four  inputs  are  required.  Two  of  these  arc  reliability 
inputs;  two  are  experience -time  inputs.  The  first  reliability  input  is  the 
decay  rate  while  standing;  that  is,  the  rate  at  which  defects  occur  while  the 
missile  is  on  strategic  alert.  This  can  also  be  expressed  as  a  mean  time 


— !  For  a  partial  relaxation  of  these  assumptions,  see  Volume  III, 
Example  B  of  TC-II  report. 


165 


between  failures  (MTBF).  The  second  input  is  also  a  reliability  parameter; 
it  is  an  index  of  the  stress  of  an  exercise,  perhaps  more  properly  thought 
of  as  the  probability  that  an  exercise  will  trigger  a  failure  in  a  system  that 
was  otherwise  good.  The  time  inputs  needed  are  the  time  off  alert  for  the 
exercise  itselt,  and  the  time  of  1  alert  to  cotrec;  a  failure,  whether  it  was 
caused  by  the  exercise  or  was  a  standing  failure  uncovered  by  the  exercise. 

1  est  Conditions :  The  decay  rate  and  the  stress  of  an  exercise  are 
both  reliability  parameters  and  are  ordinarily  observed  together  with  no 
practical  way  of  separating  them  unless  a  statistical  experiment  is  con- 

13/ 

ducted.  —  Figure  14  is  a  diagram  of  the  type  of  statistical  experiment 
that  can  be  used  to  separate  the  effect  of  time  failures  and  the  effect  of 
exercise-caused  failures.  It  consist*  of  some  sort  of  starting  transient 
(a  successful  exercise  is  a  good  beginning)  followed  by  back-to-back  exer¬ 
cises  at  Intervals  t.  This  is  a  cyclic  procedure  that  is  repeated  until  a 
satisfactory  number  of  experiences  have  been  recorded,  at  which  time  che 
test  phase  is  discontinued,  proceeding  to  an  operations'  phase  shown  on  the 
same  figure;  namely,  individual  countdowns  held  at  intervals  T,  which  in¬ 
tervals  are  to  be  determined  from  the  results  of  the  previous  tests,  accord¬ 
ing  to  the  rules  in  RM-2578.  The  reason  back-to-barV  exercises  are 
suggested  is  to  permit  separation  of  the  two  reliability  effects,  namely,  the 
standing  failure  rate  and  the  probability  of  an  exercise  causing  a  failure. 

Note  th.V  1 1 iv  first  ul  the  two  back-to-back  tests  in  each  cycle  is  subject  to 
the  time  failures  built  up  during  the  period  of  length  l  pluo  the  stresses 
associated  with  the  exercise  itself.  The  second  of  the  two  exercises,  how¬ 
ever,  takes  place  after  only  a  very  short  time  has  elapsed  and  has  almost 
no  chance  to  build  up  time  failures.  It  is  subject,  for  all  practical  purposes, 
only  tu  the  «tr»«s»s  of  the  exercise  itself.  Experience  with  the  second 
exercises  provides  an  estimate  of  the  stress  of  the  exercises.  Subtracting 
this  effect  from  the  experience  with  the  first  exercises  provides  »  measure 


13  / 

—  For  some  types  of  malfunctions,  detailed  failure  analysis  may  permit 
an  estimate  of  the  relative  importance  of  time  and  exercises.  This  is  a 
severely  limited  capability. 
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i RAM  TO  SEPARATE  EFFECT  OF  TIME  FAILURES 
ND  EFFECT  OF  EXERCISE -CAUSED  FAILURES. 


of  what  portion  of  the  defects  in  those  exercises  were  due  to  time,  and 
time  rate  of  decay  can  be  computed.  Thus,  it  is  assumed  that  the  model  of 
reliability  (the  probability  of  no  defect  during  the  exercise)  is  (1  -  q)e 

n  i«  n r KU i ty  that  an  exercise  will  trigger  a  failure  in  an  other¬ 

wise  good  system,  \  is  the  failure  rate  while  the  system  is  on  alert,  and  t 
is  the  time  since  the  system  was  last  verified.  Thus,  the  second  exercise 
in  the  back-to-back  cycle  is  used  to  determine  q,  and  the  first  exercise 
when  combined  with  this  information  gives  the  estimate  of  the  decay  rate  X . 

To  see  how  the  process  works  in  more  detail,  beginning  with  the 
expression  for  successful  exercise: 

Probability  of  no  defect  -  (1  -  q)e"^t,  and 
taking  natural  (Naperian  or  Base  e)  logarithms  of  both  sides,  leads  to: 

log  [Probability  of  no  defect]  -  log  (1  -  q)  -  X  t. 

Since  both  the  probability  of  no  defect  and  the  quantity  (1  -  q)  are  by 
definition  less  than  1.0,  the  logarithms  of  these  quantities  are  (by  definition 
ui  the  logarithm)  negative  numbers.  Thus,  each  term  of  the  expression  is 
in  fact  (if  not  in  appearance)  negative,  and  this  expression,  which  has  the 
classical  !!r.  ar  form  y  =  a  +  bx  can  be  plotted,  as  in  Figure  15. 

Comparing  this  with  the  previous  equation  (1  -q)e~  **  above,  ii  is 
seen  that  Cue  intercept  is  simply  the  negative  logarithm  of  (1  -  q),  and  the 
slope  is  simply  the  decay  rate  >..  Thus  hy  plotting  a  diagram  like  Figure 
15,  the  relation  between  the  outcome  of  exercises  at  zero  time  at...  ,ime  t, 
and  the  desired  parameters  is  seen  graphically.  Note  that  exercises  con¬ 
ducted  at  an/  two  different  intervals  would  generate  estimates  of  the  para¬ 
meters.  The  selection  of  zero  (i.e. ,  back-to-back)  as  one  of  these  times 
maximizes  the  efficiency  of  the  procedure,  from  the  standpoint  both  of 
effort  required  and  accuracy  of  results. 


—  J.  Kiefer  and  .1.  Wolfowitz,  "Optimum  Designs  in  Regression 
Problems,  "  Annals  of  Mathematical  Statistics,  Vol.  30,  1959,  pp.  271-294. 
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Optimum  Test  Conditions:  As  far  as  the  test  phase  of  weapon  system 
operation  is  concerned,  the  question  to  be  answered  is,  what  should  be  the 
v?iue  of  t  to  get  the  most  information  out  of  tcstirg  The  problem  will  be 
examined  lrom  the  standpoint  of  a  statirticaUy  best  value  of  t.  (A  problem 
which  has  been  studied  separately  is  the  value  of"**-  which  provides  the  best 
alert  capability  during  the  test  phase,  and  the  value  of  t  which  is  compat¬ 
ible  with  the  support  capability  assigned  to  the  Atlas  squadrons  in  the  field.  ) 
The  best  frequency  ui  iuiciv.il  between  back-to-back  exercises,  a  a  far  as 
the  statistical  problem  is  concerned,  could  be  wcv  ec  out  analytically  ;  but 
because  of  concern  for  certain  traps  it  is  preferable  to  do  things  a  little 
differently-.  The  proctlure  is  as  follows:  first,  set  arbitrary  reliability 
values  on  the  nine  missiles  in  an  Atlas  "D"  squr.dron.  In  other  words, 
values  of  X  and  q  are  set  arbitrarily,  and  values  of  time  off  alert  for 
exercising  and  time  to  make  a  repair  if  one  were  required  are  used.  These 
latter  values  were  obtained  from  Air  Force  personnel  at  Vandenberg  on  the 
basis  of  prior  experience  with  the  Atlas  "D"  system.  The  second  step  is  to 
simulate  the  exercise  schedule,  namely  to  simulate  the  performance  of 
back-to-back  teets  in  an  Atlas  "D"  squadron.  In  effect,  this  is  analogous 
(u;-  .ng  70q0  computer)  to  throwing  dice  to  find  out  whether  a  given  missile 
passed  in  exercise  or  failed  it.  The  outcome  is  then  analyzed,  that  is, 
cstnnE'-'s  of  the  value  of  the  decay  rate,  X  ,  the  stress  of  the  exercise,  q  , 

1C  / 

and  the  l»J:-off  capability  of  the  squadron,  r.  ,  arc  computed.  —  These 
computed  values  are  then  compared  with  the  real  values  which  had  been  sei 
for  these  particular  missiles  in  this  particular  run.  Thes«_  steps  were  re¬ 
peated  999  times  to  gem-rate  an  experience  sample;  that  is,  to  see  what 
would  happen  in  the  woild  of  probability  if  such  an  experiment  were  to  be 
run  on  a  system  which  had  particular  reliability  characteristics.  Results 
were  then  analyzed  to  see  how  good  the  estimates  were  on  the  average  and 
how  bad  they  might  prove  in  some  unusual  cases.  A  wide  range  of  reliability 
parameters  were  covered.  For  example,  a  range  of  X  was  covered  which 


—  Using  Eq.  2.  5  (p.  18)  ®f  RM-257jkto  obtain  the  ready  fraction, 
mutiplying  by  (1  -  q)  to  determine  the  fraction  successfully  counted 


and 

,lown. 
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was  indicative  of  mean  times  between  failure  all  tbe  way  from  10  days  to 
320  days;  values  of  q  were  covered  all  the  way  from  0.  1  through  0.  5.  Tne 
generalized  results  are  shown  in  Figure  16  for  *he  case  of  a  calendar  time 
limit,  specifically  180  davs.  —  In  all  cases  the  standard  error  of  pre¬ 
diction,  sometimes  called  the  standard  deviation,  could  be  reduced  by 
decreasing  t  to  about  36  days.  This  is  true  regardless  of  the  value  of  q 
(three  values  b“ing  shown  here)  and  regardless  of  the  value  of  mean  time  to 
failure.  Thus,  with  a  limitation  on  calendar  time,  the  statistically  optimum 
value  of  t  for  the  test  phase  is  approximately  36  days.  A  by-product  of  the 
simulation  program  is  the  generation  of  a  confidence  map  (Figure  17)  which 
shows  the  confidence  interval  which  can  be  associated  with  the  prediction  of 
the  lift-off  capability  of  a  squadron.  If  the  lift-off  capability  predictedby  the 
tests  »s  entered  at  the  bottom  of  the  chart,  t’  width  of  the  confidence  inter¬ 
val  is  then  read  from  the  lines  shown  for  50,  80,  or  90  per  cent  confidence. 
The  dashed  line  shown  across  the  chart  is  indicative  of  how  it  was  construct¬ 
ed;  a  missile  with  a  particular  known  reliability  (or  lift-off  capability)  was 
inserted  into  the  simulation,  and  the  results  for  50,  8(.,  and  9u  per  cent 
confidence  were  plotted  for  this  missile  and  several  others  with  different 
reliabilities  to  form  this  chart.  At  *iis  point,  the  three  objectives  stated  in 
the  1  \C  If  ‘ter  of  5  February  have  been  achieved:  to  determine  the  best 
exercise  interval  for  the  ICBM,  to  get  a  measure  of  the  lift-otf  capability, 
and  to  lint,  the  confidence  intervals  associated  with  that  measure  of  capability. 

10.  0  CONCLUSIONS 

In  this  Example  a  methodology  has  been  developed  for  establishing, 
by  test,  data  necessary  for  determination  of  appropriate  intervals  for  per¬ 
forming  scheduled  maintenance  actions  on  ICBM's.  It  has  been  shown 
through  a  simulation  model  how  these  data  are  developed,  and  how  both 


— ^  If  instead  of  calendar  time,  the  total  number  of  exercises  is  limited, 
then  it  can  be  shown  that  t  should  be  approximately  1.  5  times  the  MTBF. 
H.  Chernoff  presented  a  similar  result  in  "Locally  Optir.-al  Designs  for 
Estimating  Parameters,  "  Annals  of  Mathematical  Statistics,  Vol.  24, 

No.  4,  1953,  p.  586. 
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FIGURE  16 

GENERALIZED  RESULTS 
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r  iovJRE  17 
CONFIDENCE  MAP 
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ma’ntenancc  intervals  and  operational  capability  estimates  are  determined 
from  them. 

Finally,  it  is  concluded  that,  unless  'he  critical  data  elements  of 
exercise  stresr,  decay  rate,  exercise  time,  and  lepair  time  are  all  knowr., 
separately  and  distinctly,  operational  capability  cannot  be  predicted  nor  can 
maintenance  policy  be  validated. 
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EXAMPLE  F 


A  VULNERABILITY  MODEL  FOR  WEAPON  SITES 
WITH  INTERDEPENDENT  ELEMENTS  _L 


U  This  example  is  taken  from  "A  VTTLNEP ABILITY  MODEL  FOR 
WEAPON  <?ITES  WITH  INTERDEPENDENT  ELEMENTS,"  RAND 
P-1364,  S.  I.  Firstman,  May  27,  1958;  also  publish**'!  in  Journal 
of  ORSA,  pp  217-225,  March-April  1959. 
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ABSTRACT 


j  his  example  describes  u.  simple  "counting"  nodel,  employing  probability 
grid  transparent  overlays,  which  aids  in  the  determination  ot  the  trade-offs, 
measured  in  survival  probability,  between  site  dispersal  and  hardening  for 
a  weapon  complex  composed  of  several  interde^  endent  elements,  separated 
by  distances  of  less  than  two  lethal  radii.  The  survival-probability  expres¬ 
sions  are  obtained  through  the  use  of  Markov  chains.  An  example  of 
vulnerability  estimation  is  given. 
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1.0 


INTRODUCTION 


The  model  to  be  described  was  developed  in  order  to  determine  the 
tradeoff,  measured  in  survival  probability,  between  site  dispersal  and 
hardening  fox  a  vveapon  complex  composed  of  several  interdependent  elementi 
which  are  separated  by  distances  of  less  than  two  lethal  radii.  This  simple 
"counting"  model  employs  overlays,  probability  grids,  and  Markov  chains. 

It  is  useful  in  assessing  damage  effects  when  the  complex  is  subjected  to 
enemy  attacks  of  varying  size,  yield,  and  accuracy.  The  complex  could, 
for  example,  be  a  missile  base,  consisting  of  several  launchers  and  a 
command  and  guidance  site. 

Broadly,  the  problem  considered  is  that  of  determining  the  vulner¬ 
ability  due  to  enemy  action  of  a  weapon-complex  composed  el  several  inter¬ 
dependent  elements  (e.g.,  missiles  and  a  guidance  and  command  station), 
where  the  elements  are  separated  by  distance  of  less  than  two  lethal  radii, 
au  hy  inc  site  hardness  and  attacking -weapon,  yield.  —  Con¬ 

versely,  th  -  probability  of  survival  of  exactly  0,  1,  2,  2,  .  .  .  weapon 
elements  a  ,d  *;he  associated  command-unit(s )  is  determined  for  an  enemy 
attacK.  of  «  specified  magnitude,  against  the  complex.  In  order  for  each 
weapon- element  to  i>c  used  after  an  attack,  both  it  and  an  element  called 
command  must  survive.  Using  the  model,  it  is  possible  to  determine  the 
desired  survival  pro’oabi  ities  for  many  combinations  of  the  several  variables 
enemy-weapon  CEP,  enemy-weapon  yieid,  encmv-wcapon  numoers,  weapon- 
element  and  command-unit  mixes,  weapon-element  or  command-unit  hard¬ 
ness,  and  weapon -element  and  command-unit  dispersal. 


2/ 

The  range  of  dispersion  distances  within  which  this  model  will  prove 
useful  is  from  about  0.  2  LR  (lethal  radii)  to  <2.0  LP.  Sites  dispersed 
less  than  about  0.  2  LR  can  usually  be  considered  as  a  oingxe  (point)  target. 
The  vulnerability  of  sites  dispersed  2.  0  LR  or  more  can  be  determined 
through  the  use  of  the  equations  of  the  model  and  the  probability  tables  of 
The  RAND  Corporation  Report  R-234,  Offset  Circle  Probabilities.  (1) 
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Conceptually,  the  method  employed  is  simple.  Diagrams  of  the 
weapon-complex  layouts  are  constructed  in  the  two-dimensi  on-event  -  spac  e 
defined  by  the  probability-density  lunct  on  of  enemy -weapon  drop  locations 
about  an  aiming  point.  The  exhaustive  set  cl  mutually -exclusive  states 
vvhich  the  system  ean  occupy  are  then  delineated  r  <>.,  left-hand  missile 
and  the  command  survive,  no  missile  survives,  etc.  Next,  the  state-to- 
state  transition  probabilities  are  defined  in  terms  of  the  simple  events  of 
the  diagram  previously  constructed.  These  expressions  are  combined  into 
a  matrix  of  transition  probabilities,  wnich  defines  a  Markov  chain,  and 
raised  to  the  powers  corresponding  to  the  number  of  enemy  weapons  being 
considered.  The  resultant  matrices  delineate  the  probabilities  of  the 
mutually-exclusive  ways  in  which  each  composite  event  can  occur,  where  a 
composite  event  is  a  single  state  or  combination  of  states,  e.g.,  two  missiles 
of  three  surviving  an  attack  of  three  ent  y  weapons.  To  evaluate  the  com¬ 
posite  event  probabilities,  the  weapon-complex  diagram  is  superimposed  on 
a  probability  grid,  and  the  probability  of  occurrence  of  each  simple  event  is 
obtained  by  counting  the  included  cells.  These  prob  bilities  are  then  com¬ 
bined  into  the  complex-event  expressions. 

2.  0  TWO  MISSILE  SITES--ONE  COMMAND  SITE 

Consider  a  weapon  complex  composed  of  two  missile  sites  (Mj  and 
M,)  an-i  one  command  site  (C).  In  order  for  a  missile  to  be  launched  after 
an  enemy  attack,  both  it  and  the  command  site  must  survive  the  attack. 

All  ^ites  are  hardened  and  capable  of  withstanding  the  same  blast  effects.—^ 
(In  this  case  the  primary  vulnerability  design-factor  is  assumed  to  be  over¬ 
pressure. )  For  an  enemy  weapon  of  given  yield,  a  lethal  area  can  be  de- 
lined  about  each  site,  within  which  an  enemy  weapon  will  be  capable  of 
covering  the  site  with  a  destroying  level  of  overpressure.  If  each  of  he 
sites  is  separated  from  the  others  by  less  than  two  lethal  radii  their 


This  is  not  a  constraint  upon  the  model.  Sites  of  unequal  vulnerability 
can  be  handled  with  minor  perturbations  of  the  vulnerability  diagrams. 
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vulnerable  areas  are  as  follows: 


Let  the  missile-site  and  command-site  vulnerable  zones  be  labeled 
as  follows,  with  each  lettered  sub-set  being  the  smallest  region  en:losing 
the  letter:  S  is  the  two-dimension  event  space  corresponding  geometri¬ 
cally  to  the  area  within  which  all  bombs  (or  missiles)  rimed  at  the  arbi¬ 
trary  DGZ  will  fall.  And,  for  example,  D  is  iliat  sub-set  of  the  total  event 
space  with  whose  (joints  is  associated  the  occurrence  of  the  simple  event; 
destruction  of  both  missile  sites. 


^  Q  is  that  sub-set  associated  with  weapon  complex  invulnerability. 
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Before  proceeding,  several  definitions  are  needed.  First,  the  prob 
abilities  of  occurrence  of  the  simple  events  associated  with  each  ol  the 
sub-sets,  or  vulnerable  ;  ones,  are  defined  as: 

a  5  P'A) 

b  =  P(B) 


q  =  P(Q>. 

where 

a+b-tc  +  dle  +  f+  g  +  q-  1. 

Next,  the  several  states  possible  for  this  complex  are  tie  lilieU  aS  ih>lierw£». 

2  =  both  weapons  operative 
Mj  =  only  the  left  weapon  operative 

=  only  tl.e  right  weapon  operative 

0  =  no  weapons  operative. 

The  state -to-state  single-step  transition  probabilities  can  now  be 
di  fined  in  terms  of  the  simple-event  probabilities  determined  by  tne  vuiner 

able  <.or.es.  B/ inspection: 

p22  =  q 

i.c.,  the  probability  of  going  from  state  2  (both  weapons  operative)  to  state 
2  (both  weapons  operative)  is  equal  to  q,  the  probability  tha'  ihe  enemy 
weapon  fulls  outside  the- vulnerable  zones  of  cither  element.  Similarly, 

P2M,  =  b 

p2M2.=  a 


pm2m 


1 


0 


p00  = 


1 


:b3 


These  transition  proljj!  Titles  u.”u  Constant  from  trial  to  trial 
Therefore,  according  to  Re*** rtnee  i  they  :ar,  be  combined  into  a  transition 
matr  x  which  define*  a  Markov  chain  '"ith  const  ant  'rans  tlon  probabilities. 
The  generalisation  of  this  process  to  t’mc  dependo--  transition  matrices  is 
discussed  in  section  6.  0  of  this  example. 


P 


0 

0 

0 


b  a 

b  +  q  0 

0  a  +  q 
0  0 


1  -  (a  +  b  l  q) 
1  -  (b  +  q) 

1  -  (a  +  q) 

1 


where  the  first  row  and  first  column  correspond  to  transitions  concerning 
both  missiles,  the  second  row  and  second  column  refer  to  the  left-hand 
missile,  the  third  row  and  column  refer  to  *hc  right-hand  missile  and  the 
last  row  and  column  refer  to  no  operative  missiles.  (For  example,  the 
probability  of  going  from  state  M2  to  state  M2  in  one  step  is  equal  to  a  +  q, 
the  probability  of  an  enemy  weapon  falling  on  either  area  A  or  Q.  Obviously, 
the  zero  operative  state  is  an  absorbing  barrier. 

Fui  liit  piobabiiities  associated  with  each  state  after  11  enemy  wea¬ 
pons  have  been  independently  delivered,  the  matrix  need  be  raised  to  the 
nth  power  a. id  the  desired  terms  read  from  the  first  row  entries,  since  the 
system  always  begins  with  both  missile 3  operative.  Because  of  the  large 
number  cl  zeros,  this  ruw-into-column  multiplication  process  is  not 
difficu’t. 


The  results  of  1,  2,  and  3  attacking  weapons  will  be  giv«*n.  These 
are  the  working  equations  of  the  model  which  define  the  probability  of 
occurrence  of  each  composite -event. 

One  attacking  weapon:  ~>~ 


PJ 


in  general, 

JD 
p5/3  " 


probability  of  occurrence  of  the  composite  event-command 
and  exactly  6  weapon  elements  of  a  total  in  the  complex 
survive  an  attack  of  j  enemy  weapons. 
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p0/2  1  '  <  1  r  b  '  <l) 

{ 1 '  , 

Pi/2  *  a  +  h 


As  can  he  zieen,  the  composite-event- -one  missile  operative- -can 
occur  in  two  mutually  exclusive  ways:  either  the  left  or  riglu.  missile  can 
survive.  Consequently,  P  *B  tbe  8um  tbe  tv/°  probabilities  corres¬ 

ponding  to  the  two  included  states.  This  same  technique  is  i  sed  for  the 
other  composite  events. 

Two  attacking  weapons: 

(2)  .  ,  .  x  .  .  2  ,2  2 
Py/2  =  1  '  2c^a  +  b)  -  a  *  b  = 

P  =  a2  +  b2  +  2q(a  +  b) 

2 

=  q 


Three  attacking  weapons: 

n  (3)  _  .  n  (3)  n  (3) 
p0/2  '  1  "  pi/2  "  p2/2 

p  1^2  r  *(a  i  q)2  !  aq(a  +  q)  +  aq2  *  b(b  +  q)2  +  bafb  +  q)  +  bq2 

(3)  3 

p-,,;  -  q 


3.0  THREE  MISSILE  SITES --ONE  COMMAND  SITE 

In  order  to  examine  a  few  more  details  of  the  model,  consider  an 
event-space  for  a  left-hand  missile  (Mj),  a  middle  missile  (M2),  a  ri^ht- 
hand  missile  (Mj)  and  a  command  unit  at  the  bottom  labeled  as  follows. 

(As  can  be  seen,  this  layout  is  not  a  general  case,  but  is  specialized  to  the 
extent  that  the  missiles  are  forward  of  the  command. ) 

The  several  states  which  the  system  can  occupy  ere: 

3  s  all  three  weapons  operative 


f 
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B 


MjM2  £ 
MjM3  » 

M2M3  5 
M  j  s 

M2  5 


M3  s 
0  s 


left  and  middle  weapons  operative 
left  and  right  weapons  operative 
middle  and  right  weapons  operative 
only  the  left  weapon  operative 
only  the  middle  weapon  operative 
only  the  right  weapon  operative 
no  weapons  operative. 


The  state -to -state  single-step  transition  probabilities  -an  be 
obtained  by  inspection  from  the  diagram.  By  combining  these  probabilities, 
the  matrix  ot  transition  probabilities  is  defined.  The  row-and-column  or- 
der  is  as  above.  And.  for  example,  the  probability  of  going  from  state 
MjMj  to  state  My  in  one  step,  is  equal  to  a  +  e,  the  probability  of  an 
enemy  weapon  falling  on  either  area  A  or  E. 


The  one -attacking -weapon  survival  probability  equations  for  the 
several  composite  events  ars  read  directly  from  the  first  row  of  the  matrix. 
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II 

0. 
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One  attacking  wCapOii ! 


Po/3  '  1  -  M  b-r  +  c+  t±  Qi 


Pl/3 

pi;1, 

pin 


c  ^  ! 

a  +  b  +  c 

q 


(M 

As  can  be  seen,  p  yi  is  the  sum  of  the  probabilities  of  the  three 

1 ' 3  / j\ 

mutually  exclusive  ways  for  only  one  weapon  to  survive.  Similarly,  p,  ,L 

—  i  J 

is  the  sum  of  the  probabilities  of  the  three  mutually  exclusive  ways  for  two 
weapons  to  survive. 

The  P2  (two  attacking  weapons)  matrix,  obtained  through  row-into- 
column  multiplication  of  the  P  matrix,  yields  the  two-attacking -weapon 
equations. 


Two  attacking  weapons: 


-  > 


d(2> 

pl/3 


d<2>  .  d(2) 

p2/3  p3/3 


p  J2!,  =  2ab  +  2ac  +  2ae  +  2bc  +  2be  +  2bf  +  2c  f  +  e2  +  2eq  +  f2  +  2fq 


p^j  =  1  b1,  t  c1-  i  2aq  +  2bq  +  2cq 

(2)  2 

P3/3  =  q 


The  following  equations  for  three  attacking  weapons  are  obtained  by 
row-into-column  multiplication  of  the  P  and  P2  matrices.  This  shows  the 
relative  ease  with  which  some  rather  awkward  combinatorial  expression  1 
are  obtained. 


r(3>  _  ,  _(3)  .  _(3)  .  (3) 
p0/3  ■  1  pl/3  p2/3  p3/3 
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(%)  3  3  2  2 

p  J  -  e  4  f  4  3p  (h  4  c  +  e)  4  3b  (a  +  c  4  c  4  f) 

.  3c2(a  4  b  -r  f)  +  3f2(b  3  c  4  q)  +  3e2(a  +  b  +  q) 

4  5q2(e  +  f)  +  6bcf  +  6  cfq  -*  6  btq  +  obcq  4  6acq 
4  6beq  4  6abq  4  6abe  4  6aeq 

^2/3  =  a^a  +  *1^  +  aq(a  4  q)  4  aq2  4  b(b  4  q)2  4  bq(b  4  q)  =  hq^ 

2  2 
4  c(c  4  q)  4  cq(c  4  q)  4  cq 

d(3)  .  3 

p3/3  « 

4.  0  MORE  THAN  ONE  COMMAND  SITE 

Preceding  sections  have  considered  complexes  with  only  one 
command  site;  complexes  with  more  than  one  command  element  can  be 
handled  as  well.  Consider,  for  example,  a  complex  with  two  missile  sites, 
M  i  ,  M2  ,  forward  of  two  com  me  id  sites,  Cj  ,  C2  .  Either  command  site 
can  launch  either  missile. 
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The  exhaustive  set  of  puss  j  1  •  •  slut*,  o  for  this  complex  are: 

VjMjCjC-,  =  both  missiles  and  both  command*:  operative 
=  bo»h  missiles  and  left  cor  maud  operat've 
M  jM^C^  both  mis  lwj  -r.d  right  command  operative 
MjCjC,  -  left  missile  and  both  commands  operative 
M2C  1 C ^  =  rigbt  missile  and  both  commands  operative 
MjCj  =  left  missile  and  left  command  operative 
M E  left  missile  and  right  command  operative 
M,Cj  e  right  missile  and  left  command  operative 
=  right  missile  and  right  command  operative 
0  =  no  we  ons  operative 

Proceeding  as  before,  the  transition  matrix  is  as  follows.  This  matrix  can 
be  employed  to  obtain  the  desired  complex  event  expressions. 

5.  0  AN  EXAMPLE 

The  evelcpment  to  this  point  has  been  general.  No  assumptions  of 
probability-density  function  cr  aim  point  have  been  made;  therefore,  the 
transition  probability-matrices  and  resultant  Computing  forms  are  valid  for 
any  choice  of  the  foregoing.  To  provide  an  example  of  the  computational 
details  using  a  probability  grid,  a  portion  of  the  particular  application  for 
which  the  model  was  developed  will  be  described. 

Consider  a  hardened  missile-emplacement  consisting  of  three  mis¬ 
sile  sites  and  one  command  site.  In  order  for  either  of  the  missiles  to  re  - 
main  operative  after  an  enemy  attack,  both  the  particular  missile  and  the 
command  must  survive.  Due  to  limitations  of  the  guidance  system,  the 
missiles  must  be  separated  from  the  command  by  some  minimum  distance. 
!n  addition  to  the  required  separation,  site  dispersal  is  being  considered  to 
reduce  vulnerability,  but  the  cost  of  dispersal  prohibits  large  separation. 

In  order  to  determine  the  survival  capability  of  the  system  as  a  function  of 
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cr  o 


dollars  spent  on  dispersal.  it  a  required  that  the  expected  number  o' 
missiles  remaining  operative,  after  an  attack  by  I,  2,  or  :  enemy  weapons 
of  specified  size,  be  determined  as  a  function  ol  dispersal  distance. 

Each  of  the  missile  sites  and  the  command  ,.rc  being  designed  to 
v'ithstand  the  same  overpressure.  Then,  for  an  enemy  weapon  of  given 
yield,  a  lethal  radius  (LR)  about  each  site  can  be  deiined,  within  which  the 
site  is  vulnerable  to  the  enemy  weapon.  It  is  desired  to  use  this  model  to 
>>v<>«tigate  the  «y»tem  vulnerability  when  each  site  i?  separated  from  the 
command  by  distances  of  less  than  two  lethal  radii.  For  reasons  of  control, 
missiles  should  be  as  close  together  as  practicable;  in  the  following  sketch 
they  are  also  separ  »l-  si  by  less  than  two  lethal  radii. 

The  complex  whose  vulnerability  is  to  be  estimated  appears  as 
follows : 

Missile 

•  Missile 

nmm 


For  this  layout,  the  vulnerable  areas  are: 


LR  (typical) 
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where  th“  dimension  LR  dr  (^stanrr  t  which  tne  design  overp ressure 
will  extend  from  a  given-yield  weapon 

It  '>  assumed  that  the  delivery  accuracy  ot  the  entmv  weapon  of 
interest  can  be  cesctibed  by  the  circular  normal  distribution  where 

o  a  a 
x  *  y  = 

For  this  distribution,  CEP  =  1  ■  177a. 

Knowing  the  enemy  delivery-accuracy,  all  dimensions  can  be  trans¬ 
formed  to  multiples  of  the  standard  deviation,  a  .  After  suitable  transfor¬ 
mations,  the  dispersion  distances  to  be  used  in  subsequent  computations  are: 
0.23a,  0.46a,  0.  69a  ,  0.  P8  <*  ,  which  correspond  to  0.  6  LR,  1.  0  LR, 

1.5  LR,  and  1.9  LR,  respectively.  Survival  prooabiiities  will  be  computed 
for  1,  2,  and  3  attacking  weapons  which  will  be  assumed  to  be  aimed  ac  the 
command. 

Because  of  the  assumed  .enemy  delivery-dispersion  distribution,  the 
two-inch  standard  deviation  circular  probability  grid  of  H.  H.  Germond  ^ 
is  employed  to  determine  the  quantities  of  a,  b,  c,  .  .  .  of  the  probability 
equations.  To  do  this,  overlays  of  the  several  configurations  to  be  studied 
are  prepared  using  the  scale  of  the  probability  p  <  The  overlays  are  then 

positioned  over  the  grid  with  the  assumed  enem>  -point  (the  command 

site)  corresponding  to  the  mean  of  the  grid.  This  grid-overlay  relationship 
is  illustrated  in  Figure  1.  The  sites  are  dispersed  0.4ba  (or  1.  0  LR)  from 
each  other. 

By  counting  the  included  elements,  the  quantities  of  the  several 
sub-sets  are  seen  to  be: 


a 

= 

0. 0370 

h 

= 

0. 

0175 

b 

= 

0.  0225 

i 

= 

0. 

0165 

c 

= 

0. 0365 

j 

= 

d 

= 

0. 0280 

k 

- 

0. 

0165 

e 

= 

0. 0145 

1 

.= 

-- 

f 

= 

0.  0145 

m 

= 

0. 

0070 

8 

- 

0.  0175 

q 

= 

0. 

7720 

S 
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CELLS  OF  EQUAL  PROBAR'LI^r 

U.VU  * 


!  FIGURE  1 

GRID -OVERLAY  RELATIONSHIP  SHOWING  VULNERABLE  REGIONS 


94 


i'he3*  quantities,  which  Ai  r  the  probabilities  associated  with  the 
occu:  rence  of  the  several  simple-events,  are  then  combined  into 
complex-event  equations  pre .  .imply  delineated,  to  determine  the  . 
survival -probabilities.  These  are  presented  in  Table  I  in  the  co1 
x  =  1.  0  LR.  The  other  survival  probabilities  shown  in  Table  I  we 
mined  in  the  same  manner. 

The  expected  number  of  missiles  surviving  after  an  attack  I 
calculated  using  the  expression 

3 

R(N)  =  ^  NpN 

1 

for  each  of  the  12  combinations  of  dispersion  distance  and  numb : 
attacking  weapons.  The  results  are  shown  in  Figure  2. 

The  data  on  Figure  7.  for  x  =  0  and  x  ■  2.  0  are  ircluded  fo 
of  comparison.  The  x  =  0  points  were  computed  on  the  basis  of  ' 
circular  target;  the  x  =  2.0  points  were  computed  using  the  equa... 
this  model  and  data  from  RAND  Report  R-23<*,  Offset  Circle  Probabilities/^ 

6.  0  GENERALIZATION  OF  METHOD 

Previous  sections  nave  considered  situations  with  only  one  type  of 
enemy  weapon  delivered  per  complex  and  with  only  one  aim  point  .per  com¬ 
plex.  A  complex  with  more  than  on$  command  site,  or  a  widely  dispersed 
complex,  may  be  best  attacked  by  using  two  or  more  aim  poir*  j.  By  using 
time -dependent  variables,  and  by  additional  counting  from  probability  grids, 
this  model  could  be  extended  to  accommodate  both  several  aim  points,  and 
varying  weapon  characteristics,  per  complex.  A  general  time-depender  £ 
Markov  process  would  then  be  employed  in  place  of  the  Markov  chains  with 
constant  transition  probabilities.  The  properties  and  limitations  of  the 
general  Markov  process  are  discussed  in  Reference  2.  For  this  develop¬ 
ment,  it  is  sufficient  to  note  that  whenever  the  conditions  rf  the  attack  are 
changed  from  step  to  step--that  is  when  more  than  one  aim  point  is  employed 
or  when  different  enemy  weapon  characteristics  are  used  for  each  weapon 
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1 


I 

I 


I 

A ‘tacking  ’Veapona 


Thre  Attacking 
V  eapons 


Dispersion  distance,  x  (lethal  r  lii) 


EXPECTED  NUMBER  OF  MISSILE  SITES  SURVIVING  AN 
ATTACK  OF  1,  2,  or  3  ENEMY  WEAPONS  (DGZ  AT  BLOCKHOUSE) 


< 
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delivered- -tli-  tco’  'uqutb  described  and  the  form  ci  ir,*.  !  rd.v’Uoi.  .am* 

v  ould  remain  unchanged,  However,  the  quantities  .t,  h.  ...  would 

become  the  time -dependent  quantities,  a.,  b.,  c.,  .  .  .  the  value  ot  which 

'  *  1  (>  / 

would  be  dependent  upon  the  step,  i,  in  the  process.  —  This  will  lengthen 
the  i til  probability  expressions  and  will  requi-e  a  grid  overlay  e>er- 

rue,  peculiar  to  each  step,  to  cvilr  :■  the  probabil-  y  ''xpressions. 


^  In  general,  if  aQ  is  the  initial  state  probability  vector,  which  by  previous 
implication  is  given  by 


=  (1.  0,  0, 


0) 


then  for  the  Markov  chain  with  constant  transition  probabilities,  the  state 
probability  vector  after  n  steps  is  given  by 


a 


n 


where  P  is  the  matrix  of  constant  transition  probabilities..  For  the  Markov 
process  with  time-dependent  transition  probabilities  a  is  given  by 

*n  "  *o<PlP2P3-  *  •  Pn> 

where  Pj,  (i  =  1  ,  2,  3,  .  .  .  n)  is  the  matrix  of  transition  probabilities  for 
step  i. 
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